DUDLEY  KNOX  LIBRARY 
NAVAL  POSTGRADUATE  SCHOOL 
MONTEREY,  CALIFORNIA   93943 


NAVAL  POSTGRADUATE  SCHOOL 

Monterey,  California 


THESIS 

THE  PROBABILITY  OF  ACCIDENTAL  NUCLEAR  WAR: 

A  GRAPHICAL  MODEL  OF  THE 

BALLISTIC  MISSILE  EARLY  WARNING 

SYSTEM 

by 

Barbara  Y.  Diegel  Marsh 

March  1985 

Thesis 

Advisor:           Maurice 

D.  Weir 

Thesis 

Co-Advisor:        Jack  B. 

Gafford 

Approved  for  public  release;  distribution  is  unlimited 


T223873 


UNCLASSIFIED 


SECURITY  CLASSIFICATION  OF  THIS  PAGE  (Whan  Data  Entered) 


REPORT  DOCUMENTATION  PAGE 

READ  INSTRUCTIONS 
BEFORE  COMPLETING  FORM 

1.     REPORT  NUMBER 

2.  GOVT   ACCESSION  NO. 

3.     RECIPIENT'S  CATALOG   NUMBER 

4.     TITLE  (and  Subtitle) 

The    Probability   of    Accidental    Nuclear 
War:    -  A   Graphical   Model    of    the 
Ballistic    Missile    Early   Warning    System 

5.     TYPE  OF   REPORT  &   PERIOD  COVERED 

Master' s    Thesis 
March,    1985 

6.     PERFORMING  ORG.    REPORT  NUMBER 

7.     AUTHOR(j) 

Barbara   Y.    Diegel    Marsh 

8.     CONTRACT  OR  GRANT  NUMBERf*.) 

9.     PERFORMING  ORGANIZATION   NAME   AND  ADDRESS 

Naval    Postgraduate    School 
Monterey,    California      93943 

10.     PROGRAM   ELEMENT,  PROJECT,   TASK 
AREA  a  WORK  UNIT  NUMBERS 

II.     CONTROLLING  OFFICE  NAME   AND   ADDRESS 

Naval    Postgraduate    School 
Monterey,    California      93943 

12.     REPORT   DATE 

March,    1985 

13.     NUMBER  OF  PAGES 

78 

U.     MONITORING  AGENCY  NAME  4    ADDRESSf//  di Iterant  from  Controlling  Office) 

15.     SECURITY  CLASS,  (of  thia  report) 

15*.     DECLASSIFICATION/  DOWNGRADING 
SCHEDULE 

16.     DISTRIBUTION   STATEMENT  (of  this  Report) 

Approved    for   public    release;    distribution    is    unlimited. 

17.     DISTRIBUTION  STATEMENT  (ol  the  abetract  entered  In  Block  20,  If  different  from  Report) 

18.     SUPPLEMENTARY  NOTES 

19.     KEY  WORDS  (Continue  on  reverse  aide  It  neceeaary  and  Identify  by  block  number) 

accidental    nuclear   war,    launch-on-warning,    launch-under- 
attack,    ballistic    missile    early   warning    system,    NORAD, 
early   warning    system,    false    alarms 

20.     ABSTRACT  (Continue  on  reverse  aide  It  neceaeary  and  Identity  by  block  number) 

Six    false    alarms    occurred   at    NORAD    in    1978,    1979,    and    1980. 
These    false    alarms    subsequently   regenerated    interest    in    launch 
policies    and    the    increased   possibility   of    accidental    nuclear 
war,    which   motivated    this    investigation.       We    construct    a    new 
model    to    address    several    questions:       What    is    the    sequence    of 
events    and   reasonable    timing    between    events    in    the    missile    warn- 
ing   system?      How   much    time    do    decision   makers    have    to    respond    to 

DD  ,  ^NRM73  1473 


EDITION  OF    1   NOV  65  IS  OBSOLETE 

S/N  0102-  LF-014-6601 


Iffl£LA£S 


SECURITY  CLASSIFICATION  O 


'&Z&S 


GE  (When  Data  Entered) 


TTMrT.ASSTFTFD 


SECURITY  CLASSIFICATION  OF  THIS  PAGE  (Whmn  Dmtm  Enft»<f) 


a  threat?   What  effects  do  United  States  launch  policies  have  on 
decision-making  time?   How  likely  is  accidental  nuclear  war? 

The  results  show  that  accidental  nuclear  war  is  not  very 
probable  with  launch-under-attack,  but  significantly  more  likely 
if  the  United  States  adopts  a  launch-on-warning  policy.   The 
final  decision  and  responsibility  to  use  these  policies,  once 
they  are  implemented,  rests  entirely  with  the  President  of  the 
United  States. 


S'N  0102-  LF-  014-6601 

2 UNCLASSIFIED 


SECURITY  CLASSIFICATION  OF  THIS  PAGEfWh»n  Dmtm  Entmrmd) 


approved  for  public  release;  distribution  is  unlimited. 


The  Probability  of  Accidental  Nuclear  War: 

A  Graphical  Model  of  the 

Ballistic  Missile  Early  Warning  System 

by 

Barbara  Y.  Diegel  Marsh 
Lieutenant,  United  States  Navy 
B.A.  ,  Indiana  University,  1974 


Submitted  in  partial  fulfillment  of  the 
requirements  for  the  degree  of 

MASTER  OF  SCIENCE  IN  OPERATIONS  RESEARCH 

from  the 


NAVAL  POSTGRADUATE  SCHOOL 
March  1985 


ABSTEACT 

Six   false  alarms   occurred   at   NORAD   in    1978,     1979,    and 
1980.      These   false    alarms   subsequently    regenerated   interest 
in   launch   policies    and  the   increased   possibility    of   acci- 
dental nuclear   war,    which   motivated    this  investigation.      We 
construct   a  new    model  to   address    several   questions:      What   is 
the   sequence  of    events  and   reasonable  timing   between   events 
in    the   missile   warning  system?      How    much    time   do    decision 
makers  have   to    respond   to   a    threat?      What    effects    do    Onited 
States   launch   policies   have    on   decision-making    time?      How 
likely  is  accidental    nuclear    war? 

The  results    show    that  accidental   nuclear   war    is   not   very 
probable  with   launch-under-attack,    but    significantly    more 
likely   if   the   Onited    States   adopts   a   launch-on-warning 
policy.      The   final    decision    and  responsibility   to    use  these 
policies,    once   they    are   implemented,    rests   entirely   with   the 
President  of  the    Onited  States. 
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I-  INTRODUCTION 

Early  warning  Information  provides  decision  makers  with 
a  description  of  enemy  forces  as  they  prepare  for,  or  actu- 
ally initiate,  an  attack.   Given  early  warning,  decision 
makers  in  the  military  and  the  government,  including  the 
President,  can  more  adequately  decide  on  a  response  during  a 
crisis.   When  policy  makers  discuss  changes  to  the  regula- 
tions pertaining  to  the  early  warning  system,  they  need  to 
realize  the  implications  of  such  policy  changes  on  the 
system.   This  thesis  presents  the  current  early  warning 
system,  discusses  proposed  launch  policies,  and  explores  the 
possible  results  from  implementing  these  policies. 

Warning  information  is  essential  for  the  survival  of  the 
many  parts  of  our  arsenal  and  its  related  control  systems. 
For  example,  the  bomber  force  depends  on  timely  early 
warning  so  that  it  may  scramble  from  ground  alert  to 
airborne  stations  where  it  is  less  vulnerable  to  nuclear 
attack.   But  the  use  of  warning  to  save  the  bomber  force,  or 
any  other  weapon  system,  addresses  only  a  narrow  aspect  of 
warning.   The  most  important  aspect  of  early  warning  is  to 
give  advance  warning  of  an  enemy's  attack,  so  that  the  deci- 
sion maker  has  a  chance  to  give  the  appropriate  response  to 
an  attack.   Both  the  United  States  and  the  Soviet  Union 
continue  to  build  systems  of  extreme  complexity  for  early 
warning.   Intelligence  systems  have  merged  with  warning 
systems,  yielding  one  overall  system  which  is  integrated 
vertically  with  military  forces. 

Future  strategic  technology  is  likely  to  make  nuclear 
war  more  thinkable,  especially  as  nuclear  weapons  spread  to 
unstable  countries  less  inclined  to  respect  the  nuclear 
threshold.   The  problem  of  nuclear  weapons  proliferation 


concerns  a  large  number  of  governments  and  is  intimately 
related  to  the  basic  energy  needs  of  both  the  developed  and 
developing  nations.   It  has  fast  become  an  issue  of  high 
politics  on  a  global  scale.   Further,  many  of  the  developing 
nations  claim  that  the  United  States,  in  the  name  of  non- 
proliferation,  seeks  to  implement  policies  that  are  highly 
discriminatory  to  the  non-nuclear  states  and  are  designed  to 
maintain  American  political,  military,  and  economic  power  at 
the  expense  of  the  poorer  nations.   Hence,  no  global 
consensus  exists  on  either  the  threat  posed  by  nuclear 
proliferation  or  the  steps  that  should  be  taken  to  deal  with 
it.   Instead,  this  issue  inflames  domestic  debate  in  many 
nations,  strains  alliance  relationships,  sharpens  the 
confrontation  between  East  and  West,  and  complicates 
concepts  of  national  and  international  security.   Within 
this  framework  of  the  threat  of  general  nuclear  war  exists  a 
concern  for  accidental  or  unintentional  nuclear  war. 

We  are  rapidly  approaching  a  decisive  point  of  demarca- 
tion in  the  history  of  the  nuclear  arms  race;  namely,  the 
first  strike  counter-force  threshold.   This  means  both  the 
arsenals  of  the  United  States  and  the  USSR  will  be  highly 
vulnerable  to  surprise  attack.   As  a  result,  efforts  to 
control  the  momentum  and  direction  of  the  nuclear  arms  race 
are  increasingly  complicated  and  the  possibility  for  acci- 
dental war  substantially  grows. 

Senator  Mark  Hatfield  describes  the  threat  as  our 
perception  of  a  Soviet  weapons  build-up,  a  nuclear  blackmail 
[Ref.  Is  p.  3].   He  describes  the  Soviet  Intercontinental 
Ballistic  Missile  (ICBM)  threat  as  impressive,  yet  destabi- 
lizing, because  we  can  no  longer  rely  on  technology  to  save 
us  from  war.   Following  a  decade  of  massive  arms  spending, 
the  Soviet  Union  comes  to  the  current  round  of  disarmament 
talks  with  a  suffering  economy.   Still,  Hatfield  claims,  the 
United  States  strategists  point  to  the  Soviet's  apparent 
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superiority  by  counting  the  number  of  Soviet  warheads  and 
comparing  this  to  the  number  of  our  warheads.   In  this 
paper,  our  real  concern  is  not  with  the  numbers  question, 
but  with  how  accurately  and  quickly  we  can  discern  if  we  are 
under  attack  and  what  should  be  the  appropriate  response. 
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II.  BACKGROUND 

A.   WHY  STUDY  THE  PROBABILITY  OF  ACCIDENTAL  NUCLEAR  WAR? 

1 .   The  Historical  Perspective 

From  our  everyday  newspapers,  we  read  about  the 
increasing  tension  and  anxiety  surrounding  the  strategic 
forces  of  the  United  States.   Since  the  close  of  World  War 
II,  the  Western  Alliance  has  feared  attacks  from  the  Soviet 
Union  in  Europe  and  in  other  United  States  defended  territo- 
ries, as  well  as  the  subjugation  of  its  power  and  ideals  to 
the  Communist  philosophy.   Of  course,  the  Soviet  Union  fears 
the  same  from  the  West.   In  between  the  super  powers  lie  the 
smaller  nations,  each  wanting  to  expand  their  own  influence 
and  power  in  the  world  in  ways  similar  to  the  super  powers, 
especially  by  building  or  buying  nuclear  weapons.   Thus, 
early  warning  systems  have  grown  to  extreme  importance  over 
the  last  thirty  years. 

Looking  at  the  Soviet  warning  system  raises  some 
deeply  troubling  issues.   When  it  is  examined  as  a  system, 
and  not  merely  as  a  physical  collection  of  radars  and 
computers,  we  see  a  consistency  betwesn  doctrine  and  capa- 
bility.  The  Soviet  doctrine  is  one  of  pre-emptive  attack, 
and  the  Soviet  capability  is  a  system  of  warning  and  command 
that  supports  such  a  strategy.   The  Soviet  experience  of 
invasion  may  help  to  explain  the  reason  for  this  approach. 

Ever  since  the  Nazi's  attack  in  1941,  the  Kremlin 
proscribed  to  the  concepts  of  surprise  attack,  pre-emptive 
attack,  and  automatic  firing.   These  policies  fuel  our 
apprehensions  about  the  Soviets,  particularly  during  times 
of  crisis.   As  recently  as  July  1982,  Defense  Minister 
Dimitri  Ustinov  iterated  the  idea  that  the  United  States 
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should   be   denied   the   freedom   of   first   use   of  nuclear 
weapons.      At   the   same  time,    he   hinted  at    renewed    Soviet 
interest   in   a   launch-on-wacning   policy.      It   is   a    mistake    to 
discount   Soviet   statements   as    mere   political  bluff.      Soviet 
threats   contain    exaggeration,    but   they  also  have    a   rationale 
that    gives   us   insight  into    their   thinking.      Automatic   or 
quick-launch   systems   are   a   preeminent  design   goal   for   the 
Soviet   ICBM  forces.       These   capabilities    are   not    a   by-product 
of    Soviet  technology;    they  are   a    guiding    principle,    and   they 
continue   to   be    an    integral   feature   of   the    Strategic  Rocket 
Forces    (SRF)  . 

The  emphasis    on   pre-emption    in   Soviet  peacetime 
doctrine   is,    of    course,    no   guarantee   that    pre-emption   would 
actually    be  used    in    a  crisis.      However,    just   the    knowledge 
of    a    pre-emptive    philosophy    adds   to   our    fear   of   surprise 
attack   from  Soviet   forces.      Also,    it   is   unimaginable   that 
the    Soviets   would  operate  their   nuclear   forces   in   a    launch- 
on-warning    mode    during   peacetime.       The   chief   consequence   of 
their   emphasis    on   pre-emption   may   be   that    it   serves   as   an 
indoctrinating    force   throughout   their  defense   organization. 
However,    once   a    country  incorporates   a   view   of   war   into   the 
planning   process,    competing    theories   of   conflict    will    prob- 
ably   receive   less   attention.       By    building   an   arsenal   and  a 
training  system    directed    toward   pre-emptive   attack,    the 
Soviets   preclude   alternative   strategies    from   consideration. 
Thus,    it   becomes   more  unlikely   that    plans   could    change    at 
the    last    moment   in    a    crisis.       Now,    in   the    1980s,    the    Soviets 
have    reached  a    virtual  nuclear    parity   with    the    United 
States.      With   an  increase   in   the   certainty    of   a    successful 
pre-emptive  attack    may  come    an   increase   in    the   probability 
of   nuclear   war    if  East-West    tensions  are   not  reduced 
[Ref.    2]. 
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2  -   The  Ca us es  of  the  Concern 

The  major  threatening  influence  on  the  evolution  of 
our  warning  system  is  the  stationing  of  Soviet  nuclear- 
firing  submarines  near  the  coastlines  of  the  United  States. 
Dp  until  the  late  1960s,  Soviet  submarines  were  located 
under  the  Arctic  ice  cap.   A  launch  of  a  Submarine-Launched 
Ballistic  Missile  (hereafter,  SLBM)  from  that  position 
provided  some  time  for  decision  makers  to  discuss  and  recom- 
mend appropriate  responses  to  that  threat.   Now,  Soviet 
Yankee  and  Delta  class  submarines  regularly  patrol  near  our 
coasts  [Ref.  3].   Depending  on  tactics  and  firing  position, 
these  submarines  could  fire  SLBHs  at  our  bomber  bases  and 
command  centers  with  flight  times  ranging  between  4  and  15 
minutes.   Then,  they  can  aim  at  Washington,  the  North 
American  Aerospace  Defense  Command  (NORAD) ,  and  the 
Strategic  Air  Command  (SAC)  in  an  effort  to  paralyze  the 
retaliatory  forces  of  the  United  States.   Even  if  our  forces 
would  be  paralyzed  only  temporarily,  an  SLBM  attack  allows 
enough  time  to  follow  up  with  an  all-out  ICBM  attack  from 
Soviet  missile  fields. 

Another  cause  for  concern  is  Soviet  rhetoric.   In 
the  spring  of  1983,  Anatoly  Alexandrov,  the  President  of  the 
Soviet  Academy  of  Sciences,  announced: 

"The  Soviet  Union  will  adopt  a  policy  of  automatic 
massive  retaliation  against  all  potential  enemies  if  the 
new  American  medium-range  nuclear  missiles  are  deployed 
in  Western  Europe."  [Ref.  4] 

Although  the  Soviets  frequently  hint  at  using  a  launch-on- 
warning  posture,  Alexandrov* s  remarks  are  more  definite  than 
previous  statements  of  the  Soviet  position.   Alexandrov 
claims  that  the  current  balance  of  strategic  forces  allows 
roughly  30  minutes  for  both  sides  to  take  steps  to  avoid  a 
nuclear  confrontation.   (This  refers  to  the  ICBM  forces,  but 
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not  the  SLBM  forces.)   He  claims  that  the  deployment  of 
missiles  in  Europe  would  limit  this  time  span  to  5-7 
minutes;  thus,  precluding  chances  to  avert  an  all-out 
confrontation.   However,  he  fails  to  mention  the  SLBM  threat 
which  has  about  the  same  time  span  to  avert  a  confrontation: 
5-9  minutes  versus  25-30  minutes  for  ICBMs.   Although  the 
Soviet  ICBM  threat  is  potentially  more  destructive  to  our 
retaliatory  forces,  the  SLBM  threat  severely  shortens 
decision-making  time  which  affects  the  launching  of  retalia- 
tory forces. 

The  mechanisms  which  might  precipitate  an  uninten- 
tional or  accidental  nuclear  war  entail  our  steady 
progression  of  technological  advances  in  eguipment,  such  as 
satellite  sensors,  and  increasingly  sophisticated  computer 
software.   These  enhanced  capabilities  allow  faster  evalua- 
tion of  events  that  take  place  in  the  atmosphere  or  space, 
as  well  as  on  the  ground,  and  they  provide  a  clearer  picture 
of  the  global  military  situation.   Yet,  errors  in  the  data 
gathering  function  (which  includes  all  sensors,  communica- 
tion links,  and  computer  systems)  already  have  caused  false 
alarms  at  NORAD,  our  main  surveillance  center.   In  this 
discussion,  a  false  alarm  is  a  display  from  the  data  gath- 
ering system  which  indicates  the  launch  of  missiles  towards 
a  United  States  defended  area  with  impact  points  in  that 
area,  but  is,  in  fact,  not  real.   Routine  missile  displays 
do  occur  every  year,  but  NORAD  does  not  label  these  as  false 
alarms.   Rather,  NORAD  resolves  these  routine  missile 
displays  using  the  usual  surveillance  procedures  prior  to 
any  need  for  decisions  from  higher  authority. 

Four  false  alarms,  occurring  in  the  fall  of  1979  and 
the  spring  of  19  80,  received  international  attention 
[Ref.  5:  p.  8].   However,  NORAD  located  and  corrected  the 
problems  surrounding  these  alarms  without  an  inadvertent 
launch  of  retaliatory  forces.   Since  then,  the  added  care 
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taken  in  the  entire  missile  warning  system  has  helped  to 
resolve  incoming  missile  displays  sooner,  severely 
curtailing  false  alarms.   No  false  alarms  have  occurred 
since  1980. 

Another  contribution  to  the  cause  of  accidental 
nuclear  war  is  the  greater  international  tension  brought 
about  by  our  increased  nuclear  stance  and  the  inclusion  of 
the  Star  Wars  weapons  system  in  our  arsenal.   This  means 
that  the  United  States  is  willing  to  take  a  risk  to  protect 
itself  from  the  threat  of  an  attack  by  establishing  a 
launch-under-attack  policy.   Most  Americans  believe  that 
their  nation  is  not  morally  capable  of  initiating  a  nuclear 
war  under  any  situation.   Yet,  the  initiation  of  a  policy, 
like  launch-under-attack  or  launch-on-warning,  sends  a 
signal  to  our  potential  enemies.   It  is  important  in  the 
interest  of  peace  that  the  Soviets  clearly  perceive  our  true 
intentions. 

3.   The  Problem  of  Accidental  Nuclear  War 

The  main  goal  of  the  United  States  military  is  to 
enhance  the  capabilities  of  our  weapons  if  we  must  use  them, 
and  to  increase  weapon  survivability  if  we  are  pre-emptively 
attacked.   But  we  also  desire  the  possibility  of  launching 
our  weapons  to  be  zero  when  we  are  not  under  attack.   We  can 
describe  this  conflict  using  a  Type  I/Type  II  error  model. 
A  Type  I  error  occurs  when  an  attack  is  coming,  but  the 
warning  process  fails  and  indicates  that  we  are  not  under 
attack;  thus,  no  counter-strike  is  launched.  k    Type  II 
error  occurs  when  no  attack  is  forthcoming,  but  the  warning 
process  fails  and  indicates  that  we  are  under  attack;  thus, 
a  counter-strike  is  launched  when  no  threat  exists,  leading 
to  an  accidental  nuclear  war.   The  matrix  in  Figure  2.1 
below  delineates  the  possibilities: 
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Figure  2.1    Type  I/Type  II  Error  flatrix 

The  two  error  types  occur  where  the  asterisks  (*) 
are  located.   On  the  one  hand,  we  want  to  lower  the 
probability  of  not  launching  a  retaliatory  strike  when  we 
are  under  attack  (the  military  does  not  want  to  make  this 
mistake).   On  the  other  hand,  we  also  want  to  lower  the 
probability  of  launching  a  retaliatory  strike  when  we  are 
not  under  attack  (i.  e. ,  causing  an  unintentional  nuclear 
war) .   Note  the  trade-off  involved  with  the  two  error  types: 
we  can  not  lower  the  probability  of  one  error  type  without 
raising  the  probability  of  the  other,  due  to  the  very  nature 
of  Type  I/Type  II  errors.   But  we  can  continue  to  search  for 
a  policy  which  gives  the  best  balance  between  Type  I  and 
Type  II  errors. 

**•   Previous  Investigations  of  the  Problem 

The  incidents  of  false  alarms  at  NORAD  generated 
several  studies  and  sparked  a  renewed  interest  in  launch 
policies.   These  studies  focused  on  a  need  to  watch  false 
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alarms,    since   a    false  alarm    that   is    not   resolved    could    lead 
to    accidental   nuclear  war. 

Bereaau    built  an    analytical    model    on   the   self- 
activation   of   a    nuclear   weapons  system   [Refs.    6,7]-      His 
molel    assumes  that   both    the    United    States   and   Soviet   warning 
and    launch   systems    are  interconnected: 
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Figure  2.2   The  Bereanu  Model 


18 


This  gigantic  system  contains  four  components--the  United 
States  warning  system,  the  United  States  launch  system,  the 
Soviet  warning  system,  and  the  Soviet  launch  system. 
Bereanu  argues  that  if  the  United  States  warning  system 
responds  to  an  alarm,  it  will  automatically  trigger  the 
United  States  launch  system  which  automatically  triggers 
the  Soviet  warning  system  which  automatically  triggers  the 
Soviet  launch  system  all  of  which  leads  to  a  nuclear  war. 
And,  if  this  was  a  false  alarm,  it  would  lead  to  an  acci- 
dental nuclear  war. 

Bereanu1 s  model  also  assumes  that  more  and  more  of 
the  human  decision  making  will  be  turned  over  to  a  computer 
system.   Thus,  Bereanu  implies  that  if  the  computer  system 
errs  and  reports  a  missile  launch  when,  in  fact,  no  launch 
has  occurred,  the  decision  maker  will  automatically  respond 
in  kind;  that  is,  launch  a  missile  in  retaliation.   However, 
is  the  total  system  interlocked  and  automatic?   This  ques- 
tion will  be  addressed  in  the  following  chapters. 

Sennott  and  Crissey  developed  a  computer  simulation 
model  and  a  queuing  theory  model  to  show  how  increasing 
false  alarms  lead  to  an  increase  in  the  probability  of  acci- 
dental nuclear  war  [Eef.  8].   The  basis  of  their  study 
revolves  around  the  apparent  increasing  number  of  false 
alarms,  but  using  a  different  definition  of  false  alarm  than 
we  use  in  this  paper.   Sennott  and  Crissey  define  "false 
alarms"  as  conferences  called  to  evaluate  possible  threats 
(which  are  otherwise  known  as  missile  display  conferences) 
and  use  the  data  to  predict  the  frequency  of  such  threats  in 
their  models.   They  then  claim  that  accidental  nuclear  war 
will  occur  if  a  false  alarm  takes  too  long  to  resolve.   That 
is,  if  the  time  required  to  resolve  the  alarm  exceeds  the 
use  them  or  lose  them  point,  then  retaliation  is  automatic. 
They  also  equated  false  alerts  with  threat  assessment 
conferences.   However,  these  definitions  do  not  coincide 
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with  NORAD's  definition  of  a  false  alarm  (which  is  incorpo- 
rated into  our  definition) ,  and  this  difference  may  affect 
the  conclusions  of  their  research. 

Steinbruner  discusses  the  background  of  the  launch- 
under-attack  policy,  an  ICBM  scenario,  and  then  centers  on 
the  command,  control,  and  communications  (C3)  problem 
[Ref.  9].   He  also  includes  the  BrDokings  model  written  by 
Morawski  and  Blair.   This  model  simulates  the  performance  of 
the  C3  system  under  four  kinds  of  damage  conditions  and 
investigates  the  ability  of  the  system  to  retaliate.   The 
article  concludes  by  stating  that  even  our  considering  a 
launch-under-attack  policy  demonstrates  the  increasing 
tensions  between  ourselves  and  the  Soviets. 

The  authors  mentioned  above  (as  well  as  others 
referenced)  hold  the  common  view  that  the  world  is  on  the 
brink  of  accidental  nuclear  war.   With  increased  interna- 
tional tension,  coupled  with  the  increasing  number  of 
missile  displays,  this  conclusion  might  appear  true  on  the 
surface.   Even  using  the  definition  of  a  false  alarm  as 
delineated  by  Sennott  et  al ,  the  apparent  increase  in  these 
alarms  may  be  explained  by  the  following  facts:   (1)  more 
sensitive  sensors  are  on  line  and  operators  must  continue  to 
calibrate,  test,  and  evaluate  them;  (2)  the  Soviets  have 
increased  their  testing  of  missiles;  and  (3)  the  Joint 
Chiefs  of  Staff  have  revised  the  criteria  for  convening 
missile  display  conferences.   Even  if  intelligence  provides 
information  regarding  a  test  shot,  NORAD  continues  to 
monitor,  evaluate,  and  test  its  system  on  these  live 
launches.   Thus,  the  detection  of  any  launch  is  added  to  the 
permanent  record. 

Several  of  the  authors  assumed  that  the  man-in-the- 
loop  would  lose  control  of  the  decision-making  process  by 
being  left  out  at  certain  points  in  the  process,  or  that  the 
data  gathering  system  makes  the  man-in-the-loop' s  decision 
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more    automatic.      On    that   basis,    the    decision  to   launch    is 
then    automatically   carried   out    by   the  computer   system.      This 
view    misses   the   intimate   relationship  between   warning   and 
alert   levels   on    the    one   hand,    and   control    of  offensive 
weapons   on   the    other.      It   also    fails    to   consider    the   checks 
and   balances    (that    is,    the    man-in-the-loop)    set   up 
throughout   the   entire  missile  warning  system. 

Many   differing  opinions  concerning    different    policy 
types   and  policy   definitions  exist   among    the   authors   cited. 
Sennott  et   al   define    launch-on-warning   to    mean  if   a    situ- 
ation  can  not   be  called   a   non- threat,    then   it  is    a    threat; 
.  therefore,    launch   [Ref.    8:    p.    2].      However,    this    definition 
does    not  completely   cover   the   current   decision   process 
employed   by    NORAD.       Steinbruner* s   definition   is    very   vague; 
he   defines    launch-under-attack    (egual   to   launch-on-warning) 
as   launching   missiles  after    acquiring   reliable   evidence   that 
a  Soviet  attack    is    underway   before   its   actual   effects   are 
felt    [Ref.    9:    p.    37].      Bracken    uses    the    term   automatic 
retaliation,    but   defines   launch-on- warning    to  include   the 
military  decision    makers,    who    are   given    emergency   authority 
to    use   nuclear    weapons  in  advance    of    hostilities,    and    who 
are    further   instructed   to    use   this   authority    if    indications 
of   an   attack   arise.      Then,    Bracken  states    that   a    launch-on- 
warning   strategy   does  not  require   any   computers    or    radar, 
although   they   are  necessary    to  implement   such   a    strategy 
smoothly. 

Although   many  different   launch    policies    appear   in 
different  articles,    only    two    stand  out   as    viable   alter- 
natives— launch-under-attack   and    launch-on-warning.       As 
described  above,    definitions    of  these   policies    vary   widely, 
depending   on  the   source.      We    offer   clearer    definitions   in 
Chapter   V   and   further  pursue    their   implications. 

In   all    the    cited    articles,    the    authors   hardly 
considered    NORAD,    left   out   the    actual    decision    process,    and 
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over-simplified    or   overlooked    many   assumptions.       Although 
these   discussions    thoroughly   delineated    the    problem,    little 
has   been   written   to   answer   the   questions    they   raise.       We 
investigate   and    discuss   these    questions   in   Chapters   III    and 
IV. 

B.       METHODOLOGY    OF    THIS    STUDY 

In   the  next    two  chapters,    we   discuss    two   parts   of   the 
missile   warning    function — data   gathering    and  decision 
making.      These    two   separate,    yet  interrelated,    parts   demon- 
strate  the   role    the    man-in-the-loop    plays    and  the    importance 
of   maintaining    this    role   as    we   consider    the   implications  of 
certain   launch    policies. 

The   Data   Gathering  Model   completely   covers   all   of   the 
mechanical   aspects — sensors,    ground    stations,    command 
posts — as  well    as  describing    decision   rules,    such    as    dual 
phenomenology.       The    Data    Gathering   Model    also  presents 
several   scenarios   of   interest   with   an  accompanying    sensi- 
tivity analysis    to   show  how    time   affects    the  decision- making 
process. 

The   Decision    Model   adds    decision    points   to   the   Data 
Gathering  Model   and    incorporates   in    greater   detail    the    same 
scenarios  from    the   Data   Gathering   Model.       The  sensitivity 
analysis   further  directs  attention   toward   the  need   for    a 
policy  to   balance   the  current   situation.       In   Chapter    V,    we 
discuss    two   types   of   launch    policies   and   their    implications. 
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III.  DATA  GATHERING  MODEL 

A.   THE  CURRENT  MISSILE  ATTACK  WARNING  SYSTEM 

The  Missile  Attack  Warning  System  consists  of  three 
parts:  (1)  sensors  to  detect  a  missile  launch,  (2)  computer 
centers  and  communication  links  to  process  and  distribute 
the  data  from  the  warning  system,  and  (3)  command  posts 
which  analyze  data  and  assess  the  implications  of  the 
warning  information  and  direct  appropriate  actions.   Major 
components  of  each  of  the  above  parts  follow: 

1  •   Missile  Warning  Sensors 

a.  Satellite  Early  Warning  System  (SEWS) 

— detects  infrared  trail  of  a  burning  missile  motor 

— provides  overlapping  coverage  for  the  Soviet  Union  and 
China  (for  ICBMs) 

—  provides  overlapping  coverage  for  the  Atlantic  and 
Pacific  Oceans  (for  SLBMs) 

— transmits  real-time  information  due  to  the  nature  of  the 
SLBM  detection  problem 

--ground  stations  process  and  forward  data  to  the  command 
posts 

b.  Ballistic  Missile  Early  Warning  System  (3MEWS) 

0)   Large  Tracking  Radar  in  Greenland,  England, 
and  Alaska. 

—  detects  and  continuously  searches  for  an  object 
--operates  on  several  UHF  frequencies 
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— provides  precise  data  on  the  character  and  magnitude  of 
a  missile  attack 

(2)   Static  Radar  in  Greenland  and  Alaska. 

--evaluates  missile  position  and  velocity 

— calculates  the  trajectory,  impact  point,  impact  time, 
and  launch  point 

c.  Pave   Paws 

— a   large   multi-targeting    phased   array    radar   in   California 
and    Massachusetts 

— operated  and   maintained    by    the    Strategic   Air    Command 

— primarily   detects  SLBMs 

— relays   the    characterization  of    the   attack   to    NORAD,    SAC, 
and   the   National    Command    Authorities     (NCA) 

— simultaneously    detects   and   discriminates  many    objects 
while   providing    early   warning   data,    launch,    impact, 
position,    and   velocity   information 

--provides   automatic  detection,    track    initiation,    and 
mission   decisions 

— operates   at    UHF    frequencies 

d.  Perimeter  Acquisition   Radar   Attack   Character- 
ization   System    (PAECS) 

— 'located   in    North    Dakota 

— -tracks  incoming   ICBfls 

—  directs   the    launching   of   missiles 

— -very  accurate 
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e.  Two  Radars  in  the  Southern  United  States 
— long  range  phased  array  radars 

— uses  pattern  recognition  of  current  space  objects 

--back-up  system  performs  a  full  search  with  human 
intervention 

— operates  on  UHF  frequencies 

— supplements  SLBM  detection  from  the  Gulf  of  Mexico 

--receives  inputs  from  BMEWS  and  the  United  States  Navy 
Space  Surveillance  (SPASUR)  network 

f.  Cobra  Dane 

—  a   large,    real-time  tracking    phased   array   radar    in    the 
Aleutian   Islands   of   Alaska 

--detects   and    tracks  ICBMs,    SLBMs,    and    satellites 

— predicts   impact    points 

—  primarily   collects  intelligence    data 

2 .  Ground    Processing   and    Comrnan ication   System 

— ground   stations   in  the   continental    United  States   and 
overseas  which    process   the   data    from    the   sensors 

— communication   processing  stations   co-located    with   the 
sensors 

A    thorough   discussion  of    the    communication    function    follows 
later    in  this  chapter. 

3 .  Command  Posts 

a.   North  American  Aerospace  Defense  Command  (NORAD) 
— described  later  in  Section  D  of  this  chapter 
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b.  Strategic  Air  Command    (SAC) 

— located    (underground)    in   Omaha,    Nebraska 

— has    the   authority  and   responsibility   to   launch    the 
nuclear   bomber   force   to    protect   it 

—  maintains   a   small  percentage    of    the    bomber   force   on 
constant  alert 

— operates   and  constantly    maintains  an   airborne   command 
post 

c.  National   Military   Command  Center    (NMCC) 
— located   in    the   Pentagon 

— anticipates   and    evaluates   foreign   crises 

—  point  of   contact    for   the  President   to    obtain    information 
and   command   the    nuclear   forces 

d.  Alternate  National   Military    Command   Center 
(ANMCC) 

—  located    (underground)    in   Fort   Richie,    Maryland 

— acts  as   the    alternate  location   for    NMCC    with    the   same 
functions   as   NMCC 

The   missile    warning   system   employs  a    two-step   process 
for    identifying    a    missile    launch    and    assessing    the    threat    to 
the    North   American    continent.       First,    the    infrared   warning 
satellites   detect   the  infrared   signature    of   a   burning 
missile   motor.       Ground-based  radars    provide  back-up   confir- 
mation  data  and   rely    on  detection   using    a    different   physical 
phenomenon;    i.    e.,    radar    tracking   of   a   physical    object    as 
opposed   to   detecting    the    infrared   signature.      This    two-step 
process   is   called   dual  phenomenology    and   minimizes    the    like- 
lihood  of  mistaking   some   natural   phenomenon   for    a   launch   of 
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an  enemy's  missile.  For  the  purposes  of  this  thesis,  dual 
phenomenology;  means  the  use  of  different  types  or  families 
of  sensors  to  detect  the  same  launch. 

The  BMEWS  radar  confirms  and  characterizes  a  polar  ICBM 
attack.   Pave  Paws  radar  detects  SLBM  launches  and  SEWS 
covers  both  ICBMs  and  SLBMs.   Thus,  after  the  detection  of 
an  infrared  signature,  the  BMEWS  radars  would  be  the  first 
to  detect  ICBMs;  the  Pave  Paws  radar  would  be  the  first  to 
detect  SLBMs  launched  off  either  coast.   The  twD  radars  in 
Florida  perform  the  same  function  as  the  Pave  Paws  radar  for 
missiles  coming  from  the  Gulf  of  Mexico. 

The  satellites  and  Pave  Paws  radar,  the  two  sensors  that 
detect  the  attack  of  SLBMs,  feed  their  data  directly  to  all 
four  major  command  posts  (so  all  four  receive  and  evaluate 
the  data  simultaneously)  .   In  addition,  NORAD  transmits  its 
analysis  of  any  SLBM  attack  to  the  other  three  command 
posts.   Thus,  the  duty  officers  at  the  other  sites  have  two 
separate  computations  and  displays  of  the  SLBM  launches. 
Data  from  all  other  warning  sensors  feed  only  into  the  NORAD 
command  post,  where  it  is  analyzed.   The  other  three  command 
posts  then  receive  the  results  of  the  NORAD  analysis  by 
transmission  over  the  communication  lines. 

In  order  to  ensure  that  the  communication  lines  between 
NORAD  and  the  other  three  command  posts  remain  open,  NORAD 
constantly  transmits  messages  to  the  other  sites  over 
circuits  that  would  transmit  an  actual  attack.   Normally, 
this  message  contains  test  data  so  that  all  three  sites  can 
monitor  the  condition  of  their  communication  links  from 
NORAD.   If  the  system  works  properly,  all  command  posts 
receive  similar  information.   When  any  indication  of  a  real 
threat  exists,  including  ambiguous  data,  the  four  command 
posts  begin  a  conferencing  procedure  to  evaluate  and  assess 
the  data  available. 
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If  the  Soviets  launch  SLBMs  and  ICBMs  separately  or 
simultaneously,  the  following  sequence  of  events  probably 
would  occur: 

1.  Satellites  detect  launches  of  SLBMs  or  ICBMs  shortly 
after  launch. 

2.  Pave  Paws  radar  picks  up  the  SLBMs  2-5  minutes  after 
launch. 

3.  BMEflS  radar  picks  up  the  ICBMs  within  10  minutes  of 
their  launch. 

4.  PARCS  radar  picks  up  the  ICBMs  in  the  terminal  phase 
of  flight. 

Approximately  9-12  minutes  exist  between  launch  and  impact 
of  an  SLBM.   Time  between  launch  and  impact  of  an  ICBM  is 
approximately  25-3  0  minutes.   Since  an  SLBM  can  destroy  a 
large  portion  of  our  ground-based  sensors  and  command  posts, 
the  time  our  current  system  is  fully  operational  could  be 
severely  shortened.   This  does  not  mean  that  the  entire 
system  would  disappear  at  the  end  of  the  approximate  9  min- 
ute period.   But  then  we  could  only  depend  on  those  assets 
that  survive  the  initial  attack;  that  is,  assets  that  are 
airborne  in  time  to  escape  the  attack.   Thus,  the  short 
interim  between  detection  of  an  attack  and  destruction  of 
the  major  portion  of  our  command  and  control  structure  puts 
a  severe  stress  on  the  decision  maker. 

B.   SENSOR  PROCESSING 

The  sensor  evaluation  process  entails  the  following 
steps: 

1.  An  event  triggers  a  sensor. 

2.  The  satellite  sensor  relays  a  signal  to  its  respective 
ground  station. 
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3.  The  sensor  ground  station  computer  interprets  the 
radar  signals. 

4.  The  computer  system  analyzes  the  signals. 

5.  The  computer  system  relays  its  analysis  to  the  system 
operator . 

6.  The  computer  system  generates  a  message  to  the  command 
posts. 

7.  The  command  post  verifies  if  an  actual  message  was 
sent  . 

8.  The  sensors  continue  to  follow  the  path  of  the  object 
and  send  update  messages  . 

In  every  step  of  the  above  procedure,  the  man-in-the- 
loop,  observes  and  evaluates  the  processed  data.   Therefore, 
the  processed  data  will  be  declared  a  false  alarm  if,  in  the 
experience  of  the  man-in-the-loop,  the  processed  warning 
data  indicates  a  false  display  of  a  launch  which  may  be 
caused  by  some  natural  phenomenon,  or  the  man-in-the-loop 
has  little  confidence  in  what  the  computer  system  tells  him 
about  the  supposed  threat.   Likewise,  if  a  computer  compo- 
nent fails,  perhaps  generating  a  false  display,  but  the 
sensors  never  register  a  missile  launch,  then  the  man-in- 
the-loop  will  also  recognize  this  as  a  false  alarm. 

C.   COMMAND  CENTER  PROCESSING 

Both  NORAD  and  SAC  receive  missile  warning  data  from 
SEWS  and  Pave  Paws  radars.   NORAD  receives  data  from  BMEWS, 
Cobra  Dane,  and  PARCS  radars  and  sends  summary  messages  to 
SAC.   NMCC  and  ANMCC  receive  only  a  summary  of  the  missile 
warning  data  from  NORAD.   Since  NORAD  obtains  more  informa- 
tion (ICBM  and  SLBM  data)  than  any  other  command  post  in  the 
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system,    the  Commander-in-Chief   of   NORAD     (hereafter,    CINC 
NORAD)    assesses   the    sensor   warning   data. 

If   the   data    gathering   system    indicates   a   launch, 
specialized  centers   in  the   Cheyenne    Mountain   Complex   are 
activated.      The    Missile   Warning  Center  calls   the    individual 
sensor   sites   to    confirm   the    validity    of   the   indication    of 
launched   missiles.       The   Space   Center   states    whether   the 
indicator   is  or    is    not   one   of   the   over   4,000    objects   already 
in   space.      The   Solar  Center    reports   any   solar   activity.      The 
Intelligence  Center   discloses   any  information   which    would 
add    to   the   definition  of   the    indicator.      With  all   this 
information  combined,   CINC   NORAD    makes   a    total   assessment   of 
whether   the   indicator  is    a  real   launch    threat   to    North 
America. 

If   the   satellites   trigger    the   warning    process,    any    one 
of    the   four   command    posts  can   call   a    conference.       At   the 
conference,    CINC    NORAD  makes   decisions    regarding    the 
threat/no  threat   situation   evaluated    by   the   sensors   with 
inputs   from    the   other  command    posts.      Me   discuss    this 
conferencing   procedure  in   detail   in   Chapter   IV. 

D.       NORAD' S    ORGAHIZATION    AND    MISSION 
1.      The  Sarlj  History   of    NORAD 

To   better   understand  the   Data   Sathering    Model,    and 
later,    the   Decision    Model,    it   is    important    to  realize   where 
NORAD   fits   into    the    picture    and   how    NORAD* s   mission    affects 
the    question   of    accidental   nuclear   war. 

By   the    mid-fifties,    the   United   States  Air    Force  had 
the   technology    of   continuous   warning    information.      Only   by 
redesigning   their  formal   organizational    structure   to    fit 
this    new   information   technology  could   the    Air   Force    pros- 
ecute  a   war   successfully.      This  resulted    in   the   creation   of 
NORAD   in    1957.       As   the  central   processor   of   real-time 
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warning  information,  NORAD  became  a  joint  United  States- 
Canadian  command  because  of  the  location  of  radars  and 
fighter  bases  in  Canada.   Its  job  included  the  integration 
of  BMEWS,  Sound  Surveillance  System  (SOSUS)  ,  Distant  Early 
Warning  (DEW)  Line,  and  other  information  sources  for  an 
overall  warning  estimate  that  would  be  relayed  to  other 
command  centers,  such  as  S&C  and  the  Pentagon. 

NORAD  is  the  central  command  post  for  continuously 
monitoring  warning  and  intelligence  information  from 
multiple  sources.   It  is,  then,  the  central  coordinating 
institution  responsible  for  determining  when  the  United 
States  is  under  attack. 

NOBAD  serves  a  critical  alerting  role  in  an  elabo- 
rate system  of  institutional  checks  and  balances  to  prevent 
unauthorized  or  inadvertent  use  of  nuclear  weapons,  either 
of  which  could  lead  to  a  nuclear  war.   The  Commander-in- 
Chief  of  SAC  (hereafter,  CINC  SAC)  does  have  the  authority 
to  order  the  launch  of  the  bomber  force  in  order  to  prevent 
its  destruction  on  the  ground  by  incoming  enemy  missiles. 
However,  this  authority  depends  crucially  on  the  threat  of 
incoming  enemy  attack,  a  condition  determined  by  CINC  NOPAD. 

2.   Today's  NORAD 

Today,  NORAD  is  a  bi-national  partnership  between 
the  United  States  and  Canada;  CINC  NORAD  is  also  the 
commander  of  the  United  States  component,  the  Aerospace 
Defense  Command  (ADCOM)  .   Canadian  forces  come  from  the 
Canadian  Forces  Air  Defense  Group,  headquartered  at  North 
Bay,  Ontario.   The  senior  representative  of  the  Canadian 
Forces  is  the  Vice  Commander-in-Chief  of  NORAD.   CINC  NORAD 
reports  to  the  Joint  Chiefs  of  Staff  (JCS)  as  representing 
the  Specified  Command,  ADCOM.   As  the  Commander  of  Aerospace 
Defense  Center,  he  reports  directly  to  the  Chief  of  Staff  of 
the  Air  Force. 
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The  NORAD  mission  includes: 

(1)  Tactical  warning  and  attack  assessment  of  bomber  or 
ballistic  missile  attack  on  North  America 

(2)  Space  surveillance,  tracking,  and  cataloging  of  all 
human-made  objects  in  space 

(3)  Satellite  protection  of  friendly  satellites,  pro- 
viding collision-avoidance  and  other  flight 
condition  information 

(U)   Satellite  attack  warning  and  verification  for  all 
United  States  satellites 

(5)  Peacetime  surveillance,  detection,  and  identification 
of  aircraft 

(6)  Support  for  the  Space  Shuttle  missions 

(7)  Operational  control  of  United  States  and  Canadian  Air 
Defense  Forces 

Also,  NORAD  has  the  responsibility  to  JCS  to  provide  world- 
wide detection  of  missile  launches  and  nuclear  events.   This 
includes  the  Pacific  area  and  Europe,  as  well  as  the  area 
adjacent  to  the  North  American  Continent. 

To  accomplish  its  mission,  NORAD  exercises  opera- 
tional control  of  the  detection  and  communications  systems, 
and  it  operates  and  maintains  the  analytical  systems  in  the 
NORAD  Cheyenne  Mountain  Complex  (NCMC) .   NCMC  provides  NCA 
and  CINC  SAC  with  real-time  missile  warning  messages  and 
NORAD  confidence  assessments. 

The  NORAD  command  post  is  in  the  underground 
Cheyenne  Mountain  Complex  in  Colorado.   A  worldwide  network 
of  sensors  gathers  and  processes  missile  warning  information 
and  distributes  warning  messages  to  other  United  States  and 
Canadian  command  posts. 
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NORAD  does  not  engage  in  any  active  defense  such  as 
ballistic  missile  defenses  designed  to  intercept  ICBMs  and 
SLBHs.   This  task  is  reserved  for  SAC.   Specifically,  NORAD 
employs  passive  defenses  that  protect  targets  by  such  means 
as  warning,  mobility,  and  sheltering  forces. 

E.   DATA  GATHEBIHG  MODEL  FORMULATION 

In  order  to  formulate  the  Data  Gathering  Model,  we  must 
establish  several  basic  assumptions  about  the  data  gathering 
process.   Three  examples  then  illustrate  the  importance  of 
time:   we  will  model  an  ICBM  scenario,  an  SLBM  scenario,  and 
a  test  shot  scenario. 

First,  we  assume  the  timely  detection  of  incoming 
missiles.   Timely  detection  of  missiles  determines  how 
quickly  a  response  to  an  actual  or  imagined  threat  can  be 
made.   Success  in  preventing  an  accidental  nuclaar  war,  or 
in  protecting  strategic  forces,  depends  on  the  fastest 
possible  identification:   the  sooner  an  incoming  object  is 
identified  as  a  threat  or  non-threat,  the  more  time  is 
available  for  decision  makers  to  consider  appropriate 
responses. 

Second,  we  assume  that  communications  remain  intact  over 
the  entire  system  until  the  missiles  impact.   This  assump- 
tion requires  some  explanation.   As  discussed  in  Steinbruner 
[Ref.  9:  p.  40 3#  an  electramagnetic  pulse  (EMP)  from  an 
exoatmospheric  nuclear  explosion  would  cause  interruption  of 
non-hardened  and  long  range  (HF,  LF)  communications.   To 
overcome  the  effects  of  EMP,  redundant  messages  sent  over 
the  communication  lines  contain  less  information,  ensuring 
that  some  information  gets  through  the  system.   However,  it 
takes  at  least  7  minutes  after  an  SLBM  launch  before  the 
first  exoatmospheric  explosion  occurs.   Also,  we  will  not 
consider  sabotage  or  human  errors  which  could  also  disrupt 
communications. 
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Third,  we  assume  that  the  computer  system,  which 
contains  a  large  number  of  components  (both  hardware  and 
software) ,  has  high  reliability.   Performance  of  the  missile 
warning  task  requires  the  use  of  computers  and  high-speed 
communication  systems  which  both  sometimes  produce  erroneous 
data.   However,  dependency  on  computers  does  not  imply 
control  by  them,  since  the  data  gathering  system  only 
reports  and  evaluates  missile  warning  data  while  a 
completely  different  computer  system  controls  the  procedure 
for  launching  missiles.   At  every  step  of  the  process, 
experienced  personnel  evaluate  and  judge  the  meaning  of  the 
incoming  data.   Only  these  trained  personnel  can  direct  any 
action  in  response  to  what  the  warning  system  reports. 
Thorough  investigations  of  previous  false  alarms  led  to  more 
stringent  policies  and  practices  throughout  the  missile 
warning  system,  severly  curtailing  the  possibility  of  an 
inadvertent  launch.   The  additional  vigilance  of  the  man-in- 
the-loop  makes  inadvertent  launches  even  less  likely. 

1 .   The  Generic  Model 

As  stated  before,  the  Data  Gathering  Model  consists 
of  a  continuous  time  line  broken  into  finitely  many  (some- 
times overlapping)  segments,  each  of  finite  duration: 

ti.e  of  flight   tJ— -|— -i—  -r- -l— -J— ^ 

launch  impact 

Figure  3. 1    The  Generic  Data  Gathering  Hodel 

where      tO  =  time  of  launch 

t1  =  first  detection 

t2  =  system  evaluation  of  launch  (threat/no 
threat) 
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t3  =  second  detection 

tU  =  assessment  of  launch  by  decision  makers 
(threat/no  threat) 

t5  =  last  possible  time  to  decide  on  the 
type  of  response  (launch/no  launch) 

t6  =  time  of  impact 

The  time  line,  over  which  observations  are  taking 
place,  starts  with  the  friendly  forces  detecting  the 
launching  of  missiles,  and  ends  with  the  impact  of  missiles. 
Each  t(i)  is  the  time  when  the  data  gathering  system  de- 
tects, evaluates,  and  completes  its  analysis  of  the  sensor 
data  and  passes  along  the  information  to  the  decision-making 
system  so  evaluation  of  the  threat  can  be  resolved  prior  to 
impact.   The  minimum  time  to  resolution  (that  is,  the  min- 
imum amount  of  time  in  which  to  make  a  decision  to  launch  or 
not  launch)  =  (t5-t3).   Note  that  to,  t5,  and  t6  are  fixed 
points,  and  if  t4  is  greater  than  t5,  a  serious  problem 
arises.   In  the  following  examples,  the  time  sequence 
remains  the  same. 

2 .   Examples 

a.   ICBM  Scenario 

Starting  with  the  least  stressful  situation,  an 
ICBM  launch  scenario,  the  model  describes  the  following: 

tO      t1         t2         t3         t4  t5        t6 

time    of   flight         I 1 1 1 1 1 I 

0         13  5  7  27         30    minutes 

launch  impact 

Figure  3.2    An  ICBM  Scenario 
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As  in  the  general  case  above,  the  definitions  of  to  through 
t6  remain  the  same.   The  minimum  time  to  resolution  of  the 
threat  is  (t5-t3)  =  22  minutes. 

b.  SLBM    Scenario 

The  model  below  describes  an  SLBM  launch 
scenario: 

tO  tl    t2   t3   t4    t5    t6 

time  of  flight    I 1 I 1 1 1 1 

0    1     3    5     7     9     12  minutes 

launch  impact 

Figure  3.3    An  SLBM  Scenario 

Again,  the  definitions  for  tO  through  t6  remain 
the  same.   Notice  that  the  time  of  flight  for  the  SLBMs 
extremely  shortens  the  amount  of  decision  and  response  time. 
Here,  the  minimum  time  to  resolution  is  (t5-t3)  =  4  minutes. 

c.  Test  Shot  Scenario 

The  model  below  describes  the  situation  where 
the  data  gathering  system  monitors  test  shots  of  missiles: 

tO  t1    t2    t3    t4     t5    t6 

time  of  flight    I 1 1 1 1 -I 1 

6    1     3    5     7     9    22  minutes 

launch  impact 

Figure  3.U    A  Test  Shot  Scenario 

Usually,  in  a  test  shot,  the  Intelligence  Center 
informs  CINC  NORAD  that  a  test  shot  has  been  scheduled. 
However,  whether  or  not  intelligence  is  available,  the  data 
gathering  system  treats  a  test  shot  as  a  regular  launch  and 
calculates  an  impact  point.   By  t3,  the  decision  makers 
realize  it  is  a  test  shot,  but  continue  the  assessment 
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process  for  intelligence  gathering.   In  this  example,  the 
minimum  time  to  resolution  is  (t5-t3)  =  4  minutss. 

F.   SENSITIVITY  ANALYSIS 

The  critical  area  of  sensitivity  analysis  lies  in  the 
data  processing  times  in  the  above  three  examples.   The 
longer  it  takes  to  process  incoming  data,  the  lass  time 
remains  to  make  important  decisions  on  whether  we  should 
launch  our  missiles.   Thus,  shorter  processing  times  buy 
more  decision  time  (which  becomes  more  precious  as  the 
scenarios  get  more  complex)  . 

Some  uncertainty  exists  in  the  Data  Gathering  Model. 
For  instance,  sensors  and  computer  hardware  components  do 
fail,  computer  software  is  not  totally  error  frse,  and 
computer  operators  do  make  errors.   All  of  these  failures 
have  occurred  at  least  once  at  NOEAD  [Ref.  5:  pp.  5-9]. 
However,  in  every  case,  NORAD  did  discover  the  error  and 
improve  its  data  gathering  system. 

In  reality,  the  time  segments  of  the  above  Data 
Gathering  Model  are  not  as  neat  and  precise  as  described. 
As  stated  before,  these  segments  overlap  and,  sometimes,  one 
event  will  occur  before  another. 

Since  satellites  view  the  world  from  one  vantage  point 
and  ground  stations  view  it  from  another,  some  discrepancies 
arise  that  coul3  cause  problems.   For  instance,  if  SEWS 
picks  up  a  launch  in  one  place,  but  Pave  Paws  picks  it  up  in 
another,  the  system  may  display  two  launches  even  though 
only  one  has  actually  occurred.   Sometimes  4-5  missiles  look 
like  30,  especially  when  debris  is  present.   These  possibil- 
ities make  it  harder  for  the  decision  maker  to  state  high  or 
low  confidence  in  the  assessment  to  the  President  and  have 
an  effect  on  the  President's  own  response  decision. 
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In  the  scenarios  below,  we  explore  the  ramifications  of 
the  overlapping  time  segments. 

1 •   The  ICBM  Threat 

The  interval  between  tO  and  t1  is  split  into  two 
pacts.   In  the  first  30  seconds,  a  g.uick  look  report  flags 
some  phenomenon  which  could  be  a  launch.   In  the  next  1.5 
minutes,  the  initial  report  follows  with  the  probable  point 
of  launch  (the  azimuth)  and  the  direction  of  launch.   This 
information  assists  the  decision  maker  in  determining 
whether  the  launch  is  real  or  the  system  has  failed.   Since 
processing  occurs  in  the  satellite  and  at  ground  stations, 
the  time  from  tO  to  t1  could  be  more  than  2  minutes,  when 
the  system  delays  to  discriminate  between  a  natural  phenom- 
enon and  a  real  launch,  or  when  the  decision  maker  calls  a 
ground  station  to  confirm  the  display  on  the  command  post's 
computer  monitor.   In  any  case,  when  several  satellites  pick 
up  a  possible  launch,  the  data  gathering  system  automati- 
cally attempts  to  merge  the  individual  reports  into  a  single 
message,  then  transmits  this  message  to  the  decision  maker. 

In  the  interval  between  t1  and  t2  (about  30  sec- 
onds) ,  the  data  gathering  system  evaluates  the  possible 
launch,  and  by  t2,  labels  it  a  threat/no  threat.   The  next 
interval,  from  t2  to  t3,  which  allows  time  for  a  second 
detection,  can  become  quite  large.   Depending  on  what  sensor 
picks  up  the  launch,  and  the  launch  trajectory,  this 
interval  could  be  anywhere  between  3  and  7  minutes  in 
length.   The  interval  between  t3  and  t4  is  approximately  30 
seconds.   Figure  3.5  graphically  represents  these  overlap- 
ping intervals. 

We  now  explain  the  reason  for  the  3-7  minute 
interval  from  t2  to  t3.   There  are  four  major  phases  in 
launching  an  ICBM:   boost,  post-boost,  mid-course,  and 
re-entry.   The  boost  phase  usually  lasts  several  hundred 
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3  21         minutes 

2     0.5     7     0.5    17      3   minutes 

time  of  flight   I 1 1 ! J 1 I 

tO  tl  t2  t3  tk  t5  t6 

launch  impact 

Figure    3.5        The   ICBH    Time   Line 

seconds,    during    which  the   missile   starts   at   rest    and    accel- 
erates to  about    7   kilometers/second    by    the   time    it    reaches 
an    altitude  of   about   200    kilometers.      Typically,    an    ICBM   is 
a   three-stage  rocket,    each   stage   contributing   more   than    2 
kilometers/second    to   the    missile    velocity.       During    the    boost 
phase,    satellite   sensors   can    easily    detect   the   launch,    and 
the    missile   is    relatively   vulnerable. 

In  sophisticated   missile    systems,    a   post-boost   or 
deployment   phase    follows    the   boost.       This    phase   may    last 
another  several    hundred    seconds.      During    this   phase,    a    post- 
boost   vehicle   maneuvers   to   achieve   a   variety   of    very    precise 
trajectories,    and   then  deploys  individual   re-entry   vehicles 
on   each    trajectory.       The   post- boost    vehicle   carries  a    very 
accurate   inertial   guidance   system   to   determine   its   position 
and    velocity.      It   maneuvers    to   correct   any    trajectory   errors 
produced  during    the   boost  phase  and    places    the    individual 
re-entry  vehicles   on    slightly    different    trajectories   to 
attack    different   targets.      The    individual    re-entry   vehicles 
are   commonly   known   as  Multiple   Independently   Targetable 
Re-entry   Vehicles    (MIEVs) .      Since    the   post-boost    vehicle 
uses    a  much   lower    thrust    level    than    the   booster,    the   rocket 
exhaust   is   much    less   visible    to   sensors. 

After   the   re-entry   vehicles    are   deployed,    they 
follow  their   respective   trajectories    for    approximately    1000 
seconds,    climbing   to    1000   kilometers,    and    then   falling 
towards   the   earth,    eventually    re-entering    the  atmosphere. 
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This    is   the   mid-course  phase.      The    final    phase   is   re-entry 
and   lasts   from   30   to    100    seconds,    depending    on   the   specific 
trajectory   and    drag   characteristics    of   the    re-entry    vehicle. 
Figure  3.6    depicts    three    types   of    trajectories   for   an   ICBM: 
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Figure  3. 6        Three   Possible   ICBM    Trajectories 

Lofted    trajectories    (high    re-entry   angles)     result   in 
greater    re-entry    vehicle   deceleration,    thus,    requiring    an 
increased   time    of    flight,    since   the    flight    path    is    longer. 
However,    this  results  in  a    much   higher   accuracy    in    hitting 
the   target. 

In   depressed    trajectories    (low   re-entry   angles) ,    the 
re-entry  vehicle   heats  up    more,    reducing   the   accuracy   of   the 
missile.      Note    that    the   Pave    Paws    radar    (for   example)    will 
not   pick   up   a    depressed    ICBM    trajectory    as   guickly    as   it 
picks   up   the  other    two  types   of    trajectories.      For    both 
radar   and  infrared   sensors,    the   difficulty    of  the    sensor's 
job    increases   with    increased   range   and    increased    field    of 
view. 
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A  given  booster  delivers  a  given  payload  to  its 
greatest  range  on  the  minimum  energy  trajectory  and,  hence, 
is  the  most  likely  trajectory.   This  means  that  the  minimum 
time  (shortest  interval)  to  reach  t3  for  a  loftad  or  minimum 
energy  trajectory  is  about  5,5  minutes.   In  the  ICBM  scen- 
ario, 21.5  minutes  remain  for  decision-making  time  before  a 
final  response  is  reguired,  and  24.5  minutes  remain'  before 
impact  of  the  missile.   The  maximum  or  longest  interval  of 
time,  (t3-t0)  =9.5  minutes.   Since  the  decision  maker  will 
probably  take  30  seconds  to  make  an  assessment  of  high  or 
low  confidence,  this  allows  the  President  about  21  minutes 
in  the  minimum  case,  and  17  minutes  in  the  maximum  case,  to 
make  his  response  (see  Table  I) . 

The  minimum  interval  between  t5  and  t6  is  about  3 
minutes.   This  covers  the  reaction  time  required  to  launch 
our  missiles  in  a  retaliatory  strike.   Reaction  time 
includes  the  encryption  of  messages  to  launch,  the  decryp- 
tion of  those  messages  upon  receipt,  double-checking  the 
messages  for  accuracy  (that  is,  are  they  real  orders?),  and 
the  reguired  number  of  personnel  on  the  scene  to  unlock  and 
operate  the  missile  system.   Since  we  have  never  had  to 
perform  this  function,  other  than  in  a  training  exercise, 
this  minimum  reaction  time  does  not  include  any  failures  of 
components  in  the  launch  system  preventing  the  launch,  fail- 
ures of  any  personnel  to  perform  their  duties,  nor  any  other 
uncertainties  that  may  occur.   A  more  realistic  time  is 
closer  to  6  minutes.   This  amount  of  time  accounts  for  the 
completion  of  actions  from  the  above  3  minutes,  plus  any 
extra  time  for  shock,  confusion,  dismay,  denial,  and  undue 
pressure  that  would  arise  from  receiving  a  real  launch 
order.   However,  using  6  minutes  as  a  maximum  time  reguired 
to  perform  the  launch  sequence  still  leaves  the  President  18 
minutes  to  decide  a  response  to  the  threat  in  the  minimum 
case,  and  1U  minutes  in  the  maximum  case. 
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2-   The  SLBi  Threat 

The  time  intervals  up  to  and  including  t3  remain  the 
same  here  as  in  the  ICBM  scenario.   However,  the  situation 
drastically  changes  in  this  scenario  due  to  the  much  shorter 
time  of  flight  of  an  SLBM: 

3  3. 5     3   minutes 

2     0.5     7     0.5     0      2   minutes 

time  of  flight   I 1 I I I 1 1 

tO     tl     t2     t3     t4     t5     t6 

laanch  impact 

Figure  3.7   The  SLBM  Time  Line 

Figure  3.8  below  depicts  the  usual  SLBM  trajectory 
(about  1000  miles  from  shore)  together  with  a  depressed  SLBM 
trajectory.   This  graph  reveals  that  to  obtain  dual  phenome- 
nology (using  Pave  Paws  as  an  example) ,  the  time  between  t2 
and  t3  will  increase  with  a  depressed  SLBM  launch.   This 
result  severely  shortens  the  time  for  the  decision  maker  to 
assess  the  situation. 

The  graph  in  Figure  3. 9  shows  the  usual  SLBM  trajec- 
tory together  with  an  SLBM  launch  at  500  miles  from  the 
coast  (about  as  close  as  a  submarine  can  get  to  launch  an 
SLBM  if  it  is  to  hit  its  target).   When  launching  an  SLBM, 
the  trajectory  will  probably  be  lofted  to  attain  enough 
speed  and  height  to  successfully  re-enter  the  atmosphere  and 
hit  its  target.   Although  this  lofted  trajectory  is  less 
accurate  in  hitting  the  target,  the  interval  between  t2  and 
t3  increases  while  the  overall  time  of  flight  (tO  to  t6) 
decreases.   This  results  in  decreasing  the  decision  makers' 
time.   Therefore,  the  closer  the  launch  is  made  to  the 
coast,  the  less  time  remains  for  the  decision  maker. 
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Figure  3.8    Two  Possible  SLBM  Trajectories 
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Figure  3-9    Two  Possible  SLBM  Trajectories 

Recall  that  the  minimum  time  to  reach  t3  is  5.5 
minutes.   In  the  SLBM  scenario,  this  time  leaves  3.5  minutes 
decision-making  time  before  the  last  moment  a  response  can 
initiate  a  retaliatory  launch,  and  6.5  minutes  before  the 
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impact  of  the  missile.   The  maximum  time  is  (t3-t0)  =9.5 
minutes,  which  allows  no  decision-making  time  and  2.5 
minutes  to  impact.   This  analysis  explains  why  an  SLBM 
launch  is  so  stressful  for  ,the  decision  maker. 

The  decision  maker  will  probably  take  about  30 
seconds  to  make  an  assessment  and  state  either  high  or  low 
confidence.   In  the  minimum  case,  this  leaves  3  minutes  for 
the  President  to  take  action.   In  the  maximum  case,  the 
situation  has  advanced  beyond  the  cut-off  time  to  initiate  a 
launch  order. 

With  6  minutes  as  the  maximum  time  required  to 
perform  a  launch  sequence,  that  is,  (t6-t5)  =  6  minutes,  a 
decision  maker  would  have  sufficient  time  for  assessment 
since  the  minimum  resolution  time  (t3-t0)  =5.5  minutes,  but 
if  the  assessment  takes  the  usual  30  seconds,  no  time 
remains  for  the  President.   If  the  resolution  time  is 
anywhere  from  the  minimum  (t3-t0)  =5.5  minutes  up  to  6 
minutes,  the  (Jnited  States  could  still  execute  an  actual 
launch  order  in  time.   This  situation  illustrates  that  the 
demand  for  reliability  in  dual  phenomenology  and  reporting 
high  confidence,  plus  the  demand  for  reliability  in  a  launch 
order,  puts  the  decision  maker  in  a  severe  time  crunch.   In 
the  case  where  t4  occurs  after  t5 ,  or  when  an  SLBM  is 
launched  from  500  miles  vice  1000  miles,  the  overall  system 
permits  no  decision- making  time  at  all. 

The  new  capabilities  of  the  cruise  missile  present  a 
worse  case  scenario  shown  in  Figure  3.10.   Currently,  the 
United  States  has  no  policy  to  deal  with  cruise  missile 
launches.   With  such  a  short  warning  time,  a  bomber  attack 
may  be  the  only  response  possible.   Although  the  cruise 
missile  is  a  limiting  case  (so  we  will  not  discuss  it  at 
length  here)  ,  it  is  an  important  subject  for  future  investi- 
gations. 
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Figure  3,10   A  Cruise  Missile  Trajectory 

The  table  below  summarizes  the  times  discussed  in 
the  above  analysis: 


TABLE  I 
Time  Remaining  in  the  Data  Gathering  Model 


Interval 


First   Detection 
System  Evaluation 
Second   Detection 

CINC    NORAD's   Assessment 

President's   Time 
(3    minutes   to  impact) 

President's   Time 
(6    minutes   to   impact) 


ICBM 


28 

27. 

5 

minimum 

24. 

5 

maximum 

27. 

5 

minimum 

24 

maximum 

27 

minimum 

17 

maximum 

21 

minimum 

14 

maximum 

18 

SI3M 

10 

9.5 

2.5 
6.5 

2 
6 

0 
3 

0 
0 
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IV.  DECISION  MODEL 

A.   DESCRIPTION  OF  THE  CURRENT  DECISION  PROCESS 

The  missile  warning  function  involves  two  major  Air 
Force  commands — NORAD  and  SAC.   NORAD  has  the  responsibility 
for  the  management,  maintenance,  and  operation  of  all  the 
early  warning  sensors,  in  addition  to  the  overall  air  and 
space  defense  of  the  United  States.   CINC  NORAD  has  the 
responsibility  for  the  management  and  operation  of  the 
command  post  at  the  Cheyenne  Mountain  Complex,  plus  the 
responsibility  for  the  interpretation  of  missile  warning 
data  sent  from  SAC. 

SAC's  responsibilities  include  maintaining  the  airborne 
command  post,  which  conveys  the  launch  order  if  the  under- 
ground command  post  is  wiped  out.   SAC  is  also  responsible 
for  operating  its  computer  system,  which  receives  missile 
warning  data  from  SEWS  and  NORAD.   CINC  SAC  is  personally 
responsible  for  keeping  the  bomber  and  tanker  forces  in  a 
ready  status  in  case  they  must  be  launched  for  surviv- 
ability.  When  launched,  the  bomber  force  does  not  proceed 
with  an  attack,  but  follows  orders  to  go  to  holding  posi- 
tions where  it  waits  for  orders  either  to  commence  an  attack 
or  return  to  base.   SAC  repeatedly  practices  this  launching 
procedure  (using  a  small  percentage  of  the  force)  to  keep 
the  bomber  forces  continually  ready. 

A  number  of  questions  concerning  IC3M  silo  vulnerability 
and  the  missile  accuracy  of  the  Soviet  SLBMs  and  ICBMs 
persist.   The  big  question  in  the  decision  model  is  "Will 
our  ICBMs  be  able  to  ride  out  an  attack?"   If  we  believe  in 
silo  vulnerability  and  decide  to  launch  a  percentage  of  the 
ICBMs  in  the  event  of  a  real  threat,  then  the  ICBMs  are 
committed  and  can  not  be  recalled.   In  this  situation,  the 
decision  maker  must  face  the  decision  to  "use  them  or  lose 
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them."   On  the  other  hand,  the  other  two  legs  of  the  stra- 
tegic triad,  submarines  and  the  bomber  force,  are  less  vuln- 
erable when  deployed.   These  forces  also  remain  under  strict 
human  control  at  all  times.   Bombers  can  be  recalled  easily 
from  their  holding  stations,  but  the  submarine  forces  have 
more  flexible  instructions.   These  instructions  restrain 
submarine  commanders  from  launching  missiles  without  author- 
ization or  allow  them  to  maintain  a  neutral  position. 

Generally,  the  more  missiles  launched,  the  easier  it  is 
to  decide  a  threat/no  threat  situation,  since  a  massive 
launch  strongly  indicates  a  real  attack.   The  problem  arises 
when  only  one  missile  appears,  if  the  sensors  detect  some 
natural  phenomenon,  if  spurious  warning  data  enters  the  data 
gathering  system,  or  if  a  component  in  the  system  fails.   If 
the  indication  of  a  launch  comes  from  the  ocean,  this 
heightens  the  problem  even  more,  since  less  time  is  avail- 
able to  evaluate,  a.ssess,    and  respond  to  the  threat.   If 
CINC  NORAD  assesses  a  single  missile  threat  with  high  confi- 
dence, the  President's  decision  problem  becomes  extremely 
difficult. 

Next,  we  discuss  three  major  components  of  the  Decision 
Model  conference  procedure:   (1)  the  missile  display  confer- 
ence, (2)  the  threat  assessment  conference,  and  (3)  the 
missile  attack  conference. 

1 •   The  Missile  Display  Conference 

Upon  detecting  a  possible  launch,  the  missile 
warning  system  passes  its  analysis  of  threat/no  threat  to  a 
decision  maker,  and  a  formal  missile  display  conferencing 
procedure  convenes  to  evaluate  and  assess  the  analysis.   Any 
of  the  four  duty  officers  at  the  command  posts  may  call  this 
initial  conference,  if  the  data  gathering  system  at  the 
command  post  indicates  a  possible  threat.   CINC  NORAD  calls 
a  routine  missile  display  conference  whenever  changes  to  the 
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system  (such  as  position  or  configuration  changes  to 
sensors) ,  cause  unusual  information  or  conflicting  data  to 
appear. 

Since  we  must  maintain  a  highly  sensitive  system, 
many  indications  of  detections  arise  that  are  evaluated  as 
not  being  associated  with  a  real  missile  launch.   Every  year 
many  missile  display  conferences  are  called  to  deal  with 
events  other  than  potentially  threatening  or  ambiguous 
missile  launches. 

CINC  NORAD  officially  terminates  a  missile  display 
conference  when  the  decision  makers  judge  the  available  data 
to  indicate  either  the  presence  or  absence  of  a  threat  to 
North  America.   If  the  perceived  threat  turns  out  to  be  some 
natural  phenomenon  such  as  a  solar  reflection,  CINC  NORAD 
terminates  the  missile  display  conference,  declaring  the 
situation  as  no  threat.   System  operators  at  NORAD  call  the 
ground  sites  to  confirm  what  appears  on  their  displays.   If 
nothing  appears  on  the  displays  at  the  ground  sites,  the 
system  operators  at  NORAD  will  then  trace  the  problem,  but 
CINC  NORAD  will  not  call  a  threat  assessment  conference  (the 
next  conference  in  the  decision  process) .   However,  if  the 
situation  at  NORAD  agrees  with  the  display  at  the  ground 
stations,  it  is  considered  a  threat.   CINC  NORAD  then  termi- 
nates the  missile  display  conference  and  takes  the  next  step 
by  calling  a  threat  assessment  conference. 

2 .   The  Threat  Assessment  Conference 

As  stated  above,  if  CINC  NORAD  judges  a  launch  to  be 
a  threat  by  confirming  the  incoming  data  with  the  ground 
sites,  he  convenes  a  threat  assessment  conference.   This 
conference  reguires  the  addition  of  more  senior  personnel  to 
assist  the  duty  officers  at  the  various  command  posts  in 
their  evaluation  of  the  confirmed  threat.   Senior  personnel 
include  the  Chairman  of  the  Joint  Chiefs  of  Staff.   These 
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personnel  confer  in  order  to  determine  the  nature  and  magni- 
tude of  the  threat  to  North  America,  and  they  direct  prelim- 
inary steps  to  be  taken  to  enhance  force  survivability  (such 
as  preparing  for  a  SAC  take-off.)  CINC  NORAD' s  assessment 
will  contain  either  high  or  low  confidence  in  what  the 
sensors  reveal.  At  this  time,  if  the  ground  stations  report 
a  confirmation  by  more  than  one  family  of  sensors,  then  CINC 
NORAD  reports  hi^h  confidence  in  the  confirmed  threat. 

3«   The  Missile  Attack  Conference 

If  CINC  NORAD's  assessment  to  the  President  contains 
high,  confidence,  CINC  NORAD  then  convenes  a  missile  attack 
conference  which  includes  all  senior  personnel  and  the 
President.   No  missile  attack  conference  has  ever  been 
called.   To  arrive  at  a  missile  attack  conference,  the 
conclusions  of  the  two  previous  conferences  revealed  that  an 
attack  on  North  America  is  imminent.   Since  it  takes  time  to 
convene  these  conferences,  time  is  at  a  premium. 

B.   UNCEBTAINTY  II  TBE  DECISION-MAKING  PROCESS 

Nuclear  deterrence  depends  on  maintaining  the  surviv- 
ability of  strategic  forces.   Uncertainty  involving  the 
complete  success  of  a  missile  attack  on  either  the  attack- 
er's or  defender's  side  acts  as  a  powerful  deterrent  since  a 
first  strike  represents  an  unprecedented  gamble.   Intel- 
ligence information  is  rarely  complete  and  when  decision 
makers  confront  the  uncertainty  of  a  launch  during  a  confer- 
ence, they  must  weigh  the  logical  consequences  of  such  an 
act  and  decide  on  a  response  to  it.   This  deliberation 
continues  to  erode  the  time  remaining  before  our  missiles 
must  be  launched  (or  lost) . 

In  deploying  offensive  forces  for  the  purpose  of  deter- 
ring war,  the  dominant  peacetime  objective  is  that  of 
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preventing  accidental  or  unauthorized  use  of  weapons. 
Preventing  errors  of  this  type  requires  maintaining  negative 
control.   Negative  control  means  that  a  variety  of  physical 
constraints  and  organizational  procedures  make  it  highly 
unlikely  for  any  one  individual  to  fire  any  nuclear  weapons. 
It  is  equally  improbable  that  the  necessary  combination  of 
people  required  to  fire  these  weapons,  in  the  absence  of 
proper  authority,  could  be  organized. 

If  war  actually  were  to  break  out,  the  dominant  objec- 
tive changes  to  the  execution  of  retaliatory  attacks.   It 
then  becomes  important  to  minimize  failures  to  launch 
weapons  against  preassigned  targets.   Preventing  errors  of 
this  type  requires  positive  control :   the  smooth  operation 
and  precise  timing  required  to  launch  missiles.   Negative 
and  positive  control  inherently  conflict;  enhancing  one 
diminishes  the  other  to  an  extent  determined  by  the  details 
of  the  command  arrangements  for  particular  weapon  systems 
[Bef.  9:  p.  38]. 

The  issue  of  positive  and  negative  control  brings  up 
additional  uncertainty,  in  the  form  of  proper  timing  of  a 
launch.   The  decentralization  problem  made  by  the  great 
destructiveness  of  nuclear  weapons  emphasizes  the  conflict 
between  positive  and  negative  control.   A  single  location, 
or  even  a  few  locations,  can  not  control  a  modern  strategic 
arsenal  since  these  locations  may  be  identified  by  the  enemy 
and  pre-emptively  destroyed.   Thus,  many  military  officers 
at  numerous  locations  (some  mobile)  maintain  the  physical 
ability  to  fire  nuclear  weapons,  although  authorization  must 
be  given  and  elaborate  procedures  followed.   Since  the 
Soviets  have  reputed  to  do  the  same,  more  uncertainty 
involving  many  more  people  with  access  to  nuclear  weapons 
comes  into  play. 

The  response  of  the  attacked  nation  is  yet  another 
uncertainty.   It  is  impossible  to  predict  in  advance  how  the 
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politicians  will  act  in  the  face  of  an  actual  attack.   Arms 
control  treaties  enhance  the  uncertainty  in  intelligence  and 
decision  making  when  a  possible  launch  arrives  in  the  data 
gathering  system,  since  a  treaty  is  designed  to  "keep  the 
peace."   Because  a  surprise  attack  on  our  forces  is  practi- 
cally unimaginable  in  peacetime,  human  operators  may  hesi- 
tate and  rely  on  the  peacetime  checks  and  balances  designed 
to  keep  our  forces  from  going  to  war  accidentally.   The  key 
problems  here  involve  our  belief  that  nuclear  attack  and  war 
are  unthinkable,  dampening  our  response  behavior  to  launch, 
which  reguires  precise  timing.   Improving  the  warning 
sensors  and  the  communication  lines  may  ease  the  problem, 
but  such  improvements  can  not  completely  solve  it.   Because 
decades  have  passed  without  attack,  and  since  the  implica- 
tions of  authorizing  a  nuclear  war  are  unthinkable,  the 
President,  as  well  as  other  senior  military  personnel  in 
charge  of  the  response,  may  be  unwilling  to  launch  any 
missiles  immediately  upon  receipt  of  the  news  of  an 
impending  attack.   This  hesitation  in  response  could  seal 
our  fate.   The  longer  the  assessment  and  conferencing  proce- 
dures take,  the  more  opportunity  the  first  striker  has  to 
attack  again  and  further  disrupt  the  reactions  of  the 
victim.   The  victim  would  have  to  meet  the  attacker's  first 
strike  with  carefully  planned  strikes  against  the  attacking 
nation's  sensor  and  warning  systems,  as  well  as  against 
military  forces,  in  order  to  disrupt  the  attacker's  ability 
to  engage  in  additional  strikes.   The  victim  must  launch  a 
retaliatory  attack  during,  or  soon  after,  the  first  strike. 

Unavoidable  false  alarms  from  the  data  gathering  system, 
or  from  human  error,  contribute  to  the  slowing  of   the  deci- 
sion process,  since  it  takes  longer  to  confirm  an  alarm  as 
false.   While  the  complexity  of  the  system  does  make  us 
safer  from  accidental  nuclear  war,  it  only  protects  us 
against  isolated  failures.   Multiple  errors  or  malfunctions 
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invoke  confusion  in  humans  that  leads  to  a  longer  resolution 
time  of  the  alarm.   Since  the  problem  with  compound  errors, 
especially  human  ones,  also  increases  the  number  of  possible 
outcomes,  no  system  can  protect  against  all  combinations. 
The  likelihood  that  multiple  events  lead  to  trouble  in- 
creases as  the  activity  around  a  possible  threat  increases. 
Thus,  the  complexity  of  the  warning  system  may  amplify 
mistakes  when  forces  are  placed  on  alert. 

C.   DECISION  H0DE1  FORMULATION 

Let  us  assume  that  the  Soviets  have  the  ability  to 
launch  successfully  a  cooriinated  attack.   Such  an  attack 
requires  proper  timing  in  order  to  minimize  interference 
between  exploding  warheads  in  the  same  general  area  [Ref.  9: 
p.  39]. 

Again,  we  use  a  simple  time  line  to  model  the  decision- 
making process.   We  illustrate  the  decision  process  by 
including  three  examples:   (1)  an  ICBM  scenario,  (2)  an  SLBM 
scenario,  and  (3)  a  test  shot  scenario.   We  assume  that  the 
time  of  flight  of  a  missile  is  independent  of  decision- 
making time.   Also,  we  assume  that  the  decision  process 
presented  in  Section  A  of  this  chapter  pertains  here. 

Again,  we  assume  the  timely  detection  of  launched 
missiles.   Timely  detection  and  analysis  by  the  sensors 
allows  more  time  for  the  evaluation  and  decision-making 
process  and  for  response  to  the  threat  as  discussed  in 
Chapter  III.   Also,  we  assume  uninterrupted  communications 
over  the  entire  system. 

The  Decision  Model  time  line  includes  the  incorporation 
of  the  different  conferences,  and  the  minimum  time  to  reso- 
lution is  the  minimum  amount  of  time  in  which  the  decision 
makers  must  decide  to  launch  or  not  launch  a  counter-strike. 
Recall  that,  in  any  scenario,  the  way  NORAD  handles  a 
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situation  remains  the  same.   The  same  scenarios  presented  in 
Chapter  III  are  now  re- visited  below: 

1 .   The  Generic  Model 

This  scenario  describes  a  generic  launch: 


time  of  flight    I 1  —  | I 1 1 1 i 1 J 

TO   T1   T2   T3   T4   T5   T6   T7   T8   T9 

launch  impact 

Figure  4. 1    The  Generic  Decision  Model 

where     TO  =  time  of  launch 

T1  =  first  detection 

T2  =  system  evaluation  of  launch  (threat/no 
threat) 

T3  =  missile  display  conference  called 

T4  =  second  detection 

T5  =  threat  assessment  conference  called 

T6  =  assessment  of  launch  by  decision  makers 
(threat/no  threat) 

T7  =  missile  attack  conference  called 

T8  =  last  possible  time  to  decide  on  the  type 
of  response  (launch/no  launch) 

T9  =  time  of  impact 

Thus,  the  minimum  time  to  resolution  is  (T8-TU) . 

The  suggested  times  in  the  following  scenarios  indi- 
cate reasonable  times  to  impact  for  the  purposes  of  discus- 
sion [Ref.  9:  p.  39]. 
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2 .      Examples 

a.  ICBM    Scenario 

This    scenario   describes    an   ICBM    launch: 

time  TO      T1      T2      T3      T4      T5      T6      T7      T8      T9 

flight  0         1         23        56         §4      27      30    minutes 

launch  impact 

Figure  4.2        An   ICBM    Scenario 

The   definitions    of   TO  through   T9    remain    the   same    and    the 
minimum   time  to    resolution   is    (T8-I4)    =    22    minutes. 

b.  SLBM    Scenario 

This    scenario    describes    an   SLBM    launch: 

time  TO      T1      T2     T3      T4      T5      T6      T7      T8         T9 

flight  0         12356789         12   minute: 

launch  impact 

Figure  4.3        An   SLBM    Scenario 


The   definitions    of    TO  through    T9   remain    the   same.      Thus,    the 
minimum   time  to    resolution   is    (T8-T4)    =    4    minutes. 

c.      Test   Shot  Scenario 

This    scenario   demonstrates   how    a    test   shot 
affects   the   decision-making    process    as   shown   in    Figure    4. 4 
below.      In   this    example,    the   minimum   time   to   resolution   is 
(T8-T4)    =   4    minutes.      Even   if   intelligence    reports   a   test 
shot,    the  conferencing  procedure   continues    as   if    it   is    an 
unknown    threat.       At    T4,    the    data   gathering   system   evaluates 
no   threat   based    on   the   projected    point   of    impact     (usually 
the   ocean) .      Then,    the  decision   makers   realize   it   is   a    test 
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light 

TO   T1   T2   T3   T4   T5   T6 
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T7   T8    T9 
8    9    22  minutes 

launch 

impact 

Figure  4.4    A  Test  Shot 

Scenario 

shot,  and  CINC  NORAD  will  not  call  a  threat  assessment 
conference.   In  this  example,  T5,  T6  ,  T7 ,  and  T8  may  never 
occur;  however  the  launch  will  continue  to  be  monitored  to 
gather  as  much  intelligence  data  as  possible. 

In  the  case  of  a  launch  indicator  lacking  dual 
phenomenology,  at  T4  ,  the  decision  makers  assess  the  situ- 
ation and  state  whether  they  have  higji  or  low  confidence  in 
what  the  data  gathering  system  tells  them.   As  before,  the 
process  continues  until  full  confirmation  is  made  or  the 
sensors  stop  picking  up  the  launch  indicator. 

In  the  Decision  Model,  human  intervention  flays 
a  key  role  which  can  not  be  over-emphasized.   Human  inter- 
vention is  both  a  positive  and  a  negative  aspect;  positive 
because  more  minds  influence  the  decision-making  process  and 
because  a  launch  in  retaliation  is  not  automatic  but 
requires  human  intervention  to  activate  the  launch  mecha- 
nisms.  The  negative  aspects  include  the  increased  time  it 
takes  for  a  decision  to  be  made  by  a  team  of  decision 
makers.   Moreover,  these  decision  makers  are  only  human  and, 
therefore,  prone  to  error. 

D.   SENSITIVITY  ANALYSIS 

Since  the  Decision  Model  is  an  extension  of  the  Data 
Gathering  Modal,  we  will  transfer  the  ideas  from  the  sensi- 
tivity analysis  of  the  Data  Gathering  Model  to  the  sensi- 
tivity analysis  of  the  Decision  Model.   In  Figure  4.5  below, 
the  corresponding  points  of  the  two  models  are  shown: 
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The  Data  Gathering  Model 
ti.e  of  flight  tJ_ -r--i—  ,--r-l--r-,--r-l 

launch  impact 

The  Decision  Model 

time  of  flight    I 1  — I 1  — J i 1 1 1 1 

TO   Tl   T2   T3   T4   T5   T6   TV   T8   T9 

launch  impact 

Figure  4.5   Corresponding  Points  of  the  Two  Models 

From  our  analysis  of  the  Data  fathering  Model,  we 
observed  that  the  time  segments  of  the  Decision  Model  are 
not  as  precise  as  shown  in  Section  C  of  this  chapter.   These 
segments  also  overlap  and  one  event  may  occur  before 
another.   We  discuss  this  overlap  problem  in  the  examples 
below. 

1«   lie  ICBi  Threat 

The  events  TO,  T1,  and  T2  (which  correspond  to  tO , 
t1 ,  and  t2  in  the  Data  Gathering  Model)  take  the  same  amount 
of  time  as  described  in  Section  F  of  Chapter  III.   However, 
the  missile  display  conference  T3  can  not  be  called  until  T2 
=  t2  occurs.   At  the  point  T3,  the  duty  officers  of  all  the 
command  posts  confer  to  decide  if  the  threat  is  real  or 
false.   If  no  conflicting  information  arises,  and  the  deci- 
sion makers  readily  agree,  this  decision-making  process, 
which  includes  confirmation  from  the  ground  site,  will  take 
about  2  minutes.   Figure  4.6  displays  the  time  span  and  will 
be  explained  below.   Note  the  independent  overlap  of  T4  with 
T5,  T6,  and  T7: 
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<- TU * 

time       TO   T1   T2   T3   T5   T6   T7     T8   T9 
flight      0    2     2.5   3    5    6   6.5    27   30  minutes 

lauQch  impact 

Figure  4.6    Decision  Hodel  Time  Line  for  an  ICBM  Scenario 

During  this  conferencing  procedure,  the  data  gath- 
ering system  continues  to  monitor  the  launch  phenomenon.   As 
stated  previously  in  the  Data  Gathering  Hodel,  the  time  to 
obtain  a  second  detection  at  TU  (dual  phenomenology)  could 
take  anywhere  from  3  to  7  minutes,  depending  on  the 
missile's  trajectory.   (Here,  TU  corresponds  to  t3  in  the 
Data  Gathering  Hodel.)   This  means  that  the  minimum  time 
(shortest  interval)  to  TU  is  still  about  5.5  minutes  and  the 
maximum  time  (longest  interval)  is  about  9.5  minutes,  but 
the  missile  display  conference  T3  will  occur  prior  to  the 
second  detection  TU.   Even  if  dual  phenomenology  does  not 
occur  after  T3,  CINC  NORAD  will  call  a  threat  assessment 
conference  at  T5.   If  TU  =  5.5  minutes,  then  CINC  NORAD  will 
have  high  confidence  before  going  on  to  T5 ,  and  the  threat 
assessment  conference  will  probably  last  about  one  minute. 
However,  if  TU  =  9.5  minutes  (or  longer),  this  will  not  be 
the  case.   The  decision  makers  will  probably  want  more  time 
to  assess  the  situation,  hoping  to  obtain  dual  phenomenology 
before  going  on  to  the  missile  attack  conference  at  T7.   By 
T6,  however,  the  decision  makers  will  have  made  their 
assessment  (with  or  without  dual  phenomenology) .   Then,  CINC 
NORAD  will  call  the  missile  attack  conference,  reporting 
either  high  or  low  confidence  in  the  assessment  to  the 
President. 

In  the  minimum  (shortest  interval)  case,  with 
TU  =  5.5  minutes,  if  the  missile  display  conference  and  the 
threat  assessment  conference  take  1  minute  each  (overlapping 
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with  T4) ,  (T7-T6)  =  30  seconds,  and  if  the  missile  attack 
conference  takes  about  1  minute,  then  the  President  would 
have  (T8-T7)  =  2  0.5  minutes  to  decide  on  his  response  and 
23.5  minutes  to  impact  at  T9.  However,  if  any  of  the 
conferences  (T3 ,  T5,  T7)  take  longer  than  above,  the  time 
between  T7  and  T8  will  be  shortened,  leaving  less  time  for 
the  President  to  make  his  decision. 

In  the  maximum  case,  without  waiting  for  dual  pheno- 
menology, the  President  would  still  have  20.5  minutes  to 
decide  on  his  response,  but  he  would  be  working  with  a  low 
confidence  assessment.   Any  President  is  likely  to  be  reluc- 
tant in  giving  an  order  to  retaliate  without  high  confi- 
dence.  Thus,  if  TU  =9.5  minutes  and  CINC  NORAD  waits  for 
dual  phenomenology  (although  T5,  T6,  and  T7  would  still 
occur  while  waiting) ,  then  the  President  would  have  (T8-T7) 
=  17.5  minutes.   If  the  interval  between  T8  and  T9  is  actu- 
ally 6  minutes  (as  proposed  in  Section  F  of  Chapter  III) , 
this  would  allow  the  President  17.5  minutes  in  the  minimum 
case  and  13.5  minutes  in  the  maximum  case.   The  question  of 
waiting  for  dual  phenomenology,  therefore,  becomes  an  impor- 
tant one.   We  discuss  the  implications  of  various  launch 
policies  which  bear  on  this  issue  in  Chapter  7. 

2-   The  SLBM  Threat 

The  time  intervals  up  to  and  including  IS   remain  the 
same  here  as  in  the  ICBM  scenario.   But  the  situation 
becomes  more  stressful  with  the  shorter  time  of  flight  for 
an  SLBM  with  the  addition  of  conferences.   Again,  the  situ- 
ation regarding  depressed,  lofted,  and  minimum  energy 
trajectories  of  SLBMs  applies  here.   The  requirement  for 
dual  phenomenology  increases  the  time  between  T2  and  T4 
(corresponding  to  t2  and  t3  in  the  Data  Gathering  Model) 
when  the  SLBM  is  in  a  depressed  trajectory.   The  same  result 
occurs  if  a  submarine  launches  its  SLBMs  close  to  the  coast 
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as  described  in  Chapter  III.   Figure  4.7  shows  the  time  span 
for  an  SLBM  threat: 

time   TO   T1   T2    T3    T4   T5   T6   T7   T8   T9 
flight   A   2   2.5   4    ?    5    6   6-5   4   "l 2  minutes 

launch  impact 

Figure  4,7    Decision  Model  Time  Line  for  an  SLBM  Scenario 

The  minimum  time  to  T4  is  5.5  minutes.   This  time 
permits  only  3.5  minutes  total  decision-making  time  before  a 
response  is  required  from  the  President  and  only  6.5  minutes 
before  impact  of  the  missile.   If  the  maximum  time  is 
(T4-T0)  =9.5  minutes,  then  no  decision-making  time  exists, 
and  only  2.5  minutes  remain  to  impact.   As  we  mentioned 
earlier,  T4  overlaps  T5  (T3  has  already  occurred).   The 
events  T6,  T7,  and  T8  can  occur  prior  to  T4  if  the  President 
is  willing  to  make  a  decision  with  a  low  confidence  assess- 
ment.  However,  if  he  requires  dual  phenomenology,  T8  can 
not  occur  until  T4  occurs,  thus,  shortening  the  final 
decision-making  time.   Any  President  with  peaceful  inten- 
tions will  wait  until  T4  occurs  before  giving  an  order  to 
retaliate.   In  the  minimum  case,  the  President  has  (T8-T7)  = 
2.5  minutes  to  make  his  response.   In  the  maximum  case,  the 
President  has  no  time  left. 

With  6  minutes  vice  3  minutes  as  the  minimum  time  to 
perform  a  launch  sequence,  that  is,  (T9-T8)  =  6  minutes,  the 
President  would  have  no  time  to  think  if  (T4-T0)  =9.5 
minutes  and  dual  phenomenology  is  required.   In  any  case, 
the  conferences  will  have  to  be  rushed  (perhaps  only  30 
seconds  apiece),  if  any  assessment  is  to  be  given  to  the 
President  in  time  to  launch  a  retaliatory  strike  (if  that  is 
the  President's  chosen  response.)   Because  of  this  extremely 
shortened  time  interval,  the  President  may  be  forced  to  make 
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a  decision  with  a  low  confidence  assessment  from  CINC  NORAD, 
if  dual  phenomenology  does  not  occur  within  9  minutes  after 
a  launch  of  an  SLBM  attack. 
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7.  THE  PROBABILITY  OF  ACCIDENTAL  NOCLEAR  WAR 

A.   INTRODUCTION 

In  this  chapter,  we  combine  the  Data  Gathering  Model  and 
the  Decision  Model  to  show  the  implications  of  policies  such 
as  launch-on- warning  and  launch-under- at tack  for  the  early 
warning  system.   We  first  describe  the  segment  of  the  time 
line  that  affects  the  decision  to  use  one  of  these  policies. 
We  assume  the  United  States  is  operating  under  peacetime 
conditions  in  this  discussion.   Tha  time  lines  in  Figure  5.1 
represent  the  intervals  of  time  during  which  launch  policies 
affect  future  decisions: 

The  Data  Gathering  Model 

time  of  flight    I I 1 | 1 1  — = — I 1 1 

t6   t1   t2      t3      tU      t5 

launch 

The  Decision  Model 

time  of  flight    I I ] I J 1 1 I I 

TO   T1   T2   T3   T4   T5   T6   TV   T8 

launch 
Figure  5-1    Affective  Segment  of  the  Time  Line 

The  affective  time  lines  do  not  include  impact  since  after 
T8  (t5) ,  no  time  remains  to  launch  effectively  a  retaliatory 
strike.   Also,  recall  that  a  false  alarm  occurs  if  (1)  a 
launch  detection  occurs;  (2)  the  data  gathering  system 
labels  it  a  threat  by  T2  when  no  threat  exists;  and  (3)  a 
threat  assessment  conference  is  called  at  T5  before  confir- 
mation of  the  threat. 
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1978 

1009 

1979 

1544 

1980 

3815 

1981 

2851 

1982 

3716 

The  following  data  comes  from  NORAD  [Eef.  10]  and  shows 
the  number  of  conferences  called  from  1977-1983,  including 
the  false  alarms  discussed  earlier  in  Chapter  II: 

TABLE  II 
Emergency  Action  Conferences  by  Year 

year   routine  missile   conferences  called   threat 
_       dts"pl"IY       to™evatuati:     assesshent 

COJTFfStlCES  P05J>lBi;i~T2OATS         CDTFUFETTUE  S 

1977  1567  43  0 

70  2 

78  2 

149  2 

186  0 

218  0 

1983  3294  255  0 

The   routine   missile   display  conferences   do   not   fit    any 
of   the  previous    definitions    we   used   and,    therefore,    will   not 
be   considered   in   this  analysis.      Note   the   number    of   confer- 
ences  called  to   evaluate   possible   threats    (these    are   the 
missile   display   conferences,    as   we   defined   them    earlier). 
The    numbers  appear    to  increase   as   the    years   progress. 
However,    we   explained  the   cause  of   this   behavior    in    Chapter 
II.       The  false   alarms  that   occurred    in    1978,    1979,    and    1980 
resulted  in   the   threat  assessment   conferences  that    were 
called.      However,    in   those   cases,    confirmation   of   the    threat 
was   not    made:      in   each  case,    the    response    from   the   site 
indicated   that    a.    threat    did    not   exist.       In    fact,    the    site 
had   absolutely    no   indication   of  a    launch   on   their   display. 


62 


The   procedures    followed   in  those    years   differ   from    the    way 
CINC    NORAD   currently   calls   threat   assessment   conferences. 
Today,    if   no  confirmation   comes  from    the    site,    CINC    NORAD 
probably  will  stop    the  conferencing    process  at   that   point   to 
determine  if   thare    is  a   failure  at   NCMC.       Thus,    a   threat 
assessment   conference  may  not   be   called.       If    the    site 
reports   launch    and   impact    points    in    close   agreement   with 
NORAD's   incoming   data,    this   confirmation   gives   at   least   a 
low   confidence    assessment,    and   CINC    NORAD    will   continue  the 
conferencing    procedure  by   calling    a    threat   assessment 
conference.      Nevertheless,    in   the   analysis    of  the   next    two 
sections,    we  use    the   above   table   as   if    the    threat   assessment 
conferencing   situations   are   the  same    (as   described   in 
Chapter   IY)  . 

B.       POLICY    TYPES    AND    DISCUSSION 

Fe   begin   this  discussion    with    the   launch -on -warning 
case,    because   of    its    simplicity.      The   United  States   does  not 
currently  have    such   a   policy;    however,    there  are    many  advo- 
cates  of  launch- on- warning,    since    this   policy  improves   reac- 
tion   time  in   performing   a   counter-strike    launch. 

1 .      Launch -On- Warning 

Launch-on- warning   means  that    upon    detecting   the 
launch   of  an   enemy's    missiles   and   confirming   the    threat   at 
the  site    (albeit  with   low   confidence) ,    we    would    launch    some 
fraction   of   the    threatened    ICBM   force  before   those    missiles 
reached  any   of    their    targets. 

This  extremely  broad   definition   contains    several 
important   implications.       For   instance,    to    carry    out   a 
launch-on-warning   policy   in    the  event   of    an   actual   enemy 
missile   launch,    the    decision   makers    must   declare    the   threat 
confirmed;    that    is,    the   data    gathering   system   and    the 
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decision    makers   both    must   agree    that    the    situation   is   a 
confirmed   threat   situation.      Then,    CINC    NORAD   reports   low 
confidence   in   the  assessment   to   the    President.       A    launch-on- 
warning    stance   presumably   allows    more   time    for   the   bomber 
forces   to   escape   and   increases    the   amount    of    time   to   execute 
a   counter-strike.      The  SLBM    scenario,    described    in   Chapter 
IV,    makes  the   importance    of    these   two   features   extremely 
apparent. 

Using    the   table   from    Section   A,    we    can   now    ask    the 
question,    "How    often    does   a    false   alarm    occur   in    the  case   of 
a  single  system   failure?"      Recall    that   threat  assessment 
conferences   were    called   in    the   situations   where    a   false 
launch   indication   occurred;    6    times    over   6    years.      Thus,    the 
average   arrival   rate   is   one    per   year    (for   a   single   detection 
with    lew   confidence). 

Adopting    a    launch-on-warning   policy   in   peacetime 
implies   that  if   a    single   failure    occurs   in    the    system,    and 
the   site  confirms   the  threat,    then   the   following   sequence   of 
events   may   take    place: 

time  of   flight         | 1 1 | 1  — | | 

TO    T1    T2    T3    T5  T6   T7 

launch  shoot! 

Figure  5.2    Launch-On-Warning  Time  Line 

Note  the  change  to  the  Decision  Model — the  decision  maker 
does  not  wait  for  TU  (second  detection  from  a  different 
family  of  sensors)  to  occur  before  giving  an  assessment  to 
the  President.   The  President  also  does  not  necessarily  wait 
for  a  second  detection  to  give  a  launch  order. 

Thus,  a  lower  bound  for  the  expected  waiting  time 
until  an  accidental  nuclear  war  is  1  year,  if  the  President 
chooses  to  retaliate  under  the  conditions  just  described. 
What  makes  this  a  lower  bound  is  the  fact  that  a  false  alarm 
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must  persist  long  enough  without  dual  phenomenology  to 
convince  the  President  to  act  with  only  a  low  confidence 
assessment. 

In  any  case,  launch-on-warning  is  a  high  risk 
policy,  especially  when  great  international  tensions  exist 
between  the  United  States  and  the  USSR,  as  they  do  today. 
In  peacetime,  a  single  failure  without  dual  phenomenology 
puts  the  President  in  the  extremely  difficult  position  of 
deciding  how  long  to  wait  before  giving  an  order  to  launch  a 
counter- strike. 

2 .   Launch -Dnder- At tack 

The  presence  of  dual  phenomenology  (the  confirmation 
of  a  launch  by  two  families  of  sensors)  gives  much  more 
reliability  to  a  confirmed  threat.   In  previous  chapters,  we 
demonstrated  how  much  the  decision  makers  rely  on  dual 
phenomenology  to  reduce  the  chance  of  an  incorrect  response. 
We  now  discuss  how  much  better  the  warning  system  actually 
becomes. 

Currently,  the  United  States  has  a  launch-under- 
attack  policy.   In  this  thesis,  launch-under-att ack  means 
launching  some  fraction  of  the  threatened  ICBM  force  when 
the  early  warning  system  confirms  a  threat  and  that  threat 
is  assessed  with  high  confidence.   Again,  the  data  gathering 
system  and  the  decision  makers  must  agree  in  their  assess- 
ment that  the  threat  is  confirmed,  as  in  launch-on-warning. 
The  conditions  of  dual  phenomenology  and  a  predicted  impact 
point  in  friendly  territory  define  the  confirmed  threat. 
The  difference  in  this  policy  arises  from  CINC  NORADfs 
assessment  to  the  President:   here,  CINC  NORAD  reports  high 
confidence  in  what  the  sensors  reveal,  since  dual  phenome- 
nology is  required.   The  President  is  still  the  responsible 
authority  for  the  initiation  of  the  launch:   whether  it  is 
one  missile  or  many  missiles,  the  decision  to  implement  a 
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launch-under-attack    rests   with   the   President.      An   advantage 
to   this    policy    is   that  a    launch-under-attack   lessens    the 
probability  of    accidental   nuclear    war   while   maintaining   a 
strong   deterrence. 

If  the    Onited  States    continues   to    follow    a    launch- 
under-attack   policy,    what   sequence    of   events   must    occur    to 
cause   an   accidental    nuclear    war?      Since    under    launch-under- 
attack,    the   United    States    would   not    launch    a   retaliatory 
strike  if   only    one   system   failed,    a    necessary   condition  for 
accidental   nuclear   war,    in  this  case,    is    for   two    different 
false    alarms   on    two    different   sensors   to    occur.      Plus,    the 
false   alarm   on    one    system   must    overlap    the    false    alarm    on 
the   other  system.      Moreover,    the   two    systems   must    agree 
approximately   on    the    launch    and  impact    points,    so    that    the 
decision   maker    sees    the   same   launch    phenomenon   on   two    sepa- 
rate   systems.      Ihe    overlap   time   must    also    be   of   sufficient 
duration   to   allow   enough    time    to   launch    a    counter-strike. 
In   Chapter   IV,    we  assumed   three  minutes    (initially)    to   carry 
out    the   launch   order. 


radar 
system 
false  alarms 


infrared 

system 

false  alarms 


first  false  alarm 


i 
i 


overlap  time 


second  false  alarm 
Figure  5.3    The  Interval  Overlap 


The  minimum  overlap  time,  then,  is  defined  as  the  intersec- 
tion of  two  false  alarm  intervals  for  at  least  3  minutes. 
In  Figure  5.3  above,  we  assume  that  the  time  intervals  are 
stochastically  independent,  and  so  are  the  false  alarms  in 
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the  two  systems.   If  we  assume  that  the  arrival  process  of 
the  false  alarms  is  a  Poisson  process,  the  intervals  between 
arrivals  are  exponentially  distributed. 

In  order  to  calculate  an  upper  bound  foe  the  prob- 
ability of  a  double  false  alarm  using  dual  phenomenology  (a 
double  false  alarm  on  two  different  systems) ,  we  assume  the 
following: 

1.  We  disregard  the  difference  between  the  false  alarms 
on  the  two  different  systems  (assumed  above). 

2.  The  combined  rate  of  the  radar  false  alarms  and 
infrared  false  alarms  is  one  false  alarm  per  year. 

3.  The  time  between  arrivals  of  the  combined  false  alarms 
is  exponentially  distributed. 

If  all  these  false  alarms  involve  ICBM  launches 
only,  what  is  the  probability  that  two  successive  false 
alarms  occur  within  27  minutes  of  each  other  (i.  e.,  a  3 
minute  overlap)  ?   Let 

X  =  the  time  between  false  alarms 
then 

P(X  <  k  minutes)  =  1-e" 

=  1  "  {1  ♦  (-Xk)  ♦  (-Xk)2/2!  +  .  .  .} 

where  X  is  one  per  year  (that  is,  the  mean  time  to  wait  for 
a  false  alarm  is  6/6,  or  one  year).   Dropping  all  but  the 
first  three  terms  gives 

P  (X  <  k  minutes)  •*  Xk 
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in   minutes.      Note   that   the   units    for    X  and   k   must    conform. 
Since   we  assumed    that  it    takes   at   least    3    minutes    to    execute 
a  counter-strike    launch,    at    least    a    3   minute   overlap   is 
necessary.      This   is    the    "worst   case"   situation. 

The  upper  bound  (worst  case)  for  an  ICBH  scenario  is 
in  the  situation  where  a  3  minute  overlap  occurs.  Here,  the 
calculation   gives 

P  (X    <    27    minutes)    =    27/ (365 )  (24)  (60) 

=    0.000051 

Therefore,    a   lower   bound    for    the   expected    waiting   time   of 
this    event    is    1/0.000051    which    is    approximately    19,467 
years.      These  calculations   are    very    restrictive    since   we 
have    assumed   a    combined   false   alarm    rate.      This    assumption 
means   that   two    sensors  could    fail   in    the   same    family.      Prom 
what    we    have  described,    we    must  have    false    alarms    from    two 
families  of   sensors.      This    makes    the    probability    even    lower 
than    0.000051    and    the  expected   waiting   time    greater   than 
19,467   years. 

The   upper   bound    for    an    SLBN    scenario    is    for    a   3 
minute   overlap    to  occur: 

P(second  false   alarm    occurs    <    9    minutes)    =    9/(365)  (24)  (60) 

=    0.000017 

In    this   case,    the   expected    waiting    time    to   a   double   false 
alarm    is  approximately  58,400    years.      The    upper    and    lower 
bounds   of   the   ICBM    scenario   cover    this   and    all   other 
situations. 

In  conclusion,    the    United    States    will   probably    never 
accidentally   launch    a  retaliatory   strike    with  a    launch- 
unier-attack   policy,    if  the    false    alarm   rate   remains    the 
same    as   in    Table    II.      The    graph   in    Figure    5.4    shows    how    the 
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expected  waiting  time  varies  with  different  lambdas. 
However,  Adding  sabotage  and  nuclear  proliferation  raises 
the  probability  and  decreases  the  expected  waiting  time. 
Nevertheless,  with  these  probabilities  as  upper  bounds,  a 
decision  maker  will  pause  and  take  time  to  analyze  false 
alarms  under  these  conditions. 
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Figure  5.4    Expected  Waiting  Time  Versus  Lambda 


These  same  calculations  assist  the  decision  maker  in 
determining  whether  an  alarm  is  real  or  false  by  adding  the 
conferencing  procedure.   If  the  decision  maker  decides  the 
first  alarm  is  false,  then  when  a  second  alarm  occurs,  it 
merely  supports  the  fact  that  a  system  failure  has  occurred. 
Also,  including  the  conferencing  procedure  may  add  more  time 
to  the  process,  allowing  for  the  possibility  of  the  alarm 
being  confirmed  by  dual  phenomenology,  or  evaluated  as  no 
threat. 
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This  addition  of  time  to  the  decision-making  process 
could  be  a  blessing  in  disguise.   If  the  system  gives  a  10 
minute  impact  time,  but  the  decision-making  process  already 
has  taken  15  minutes,  then  probably  no  launch  has  occurred. 
Thus,  if  no  impact  materializes  by  the  10  minute  limit,  and 
the  decision  makers  still  have  not  reached  a  decision,  the 
conferencing  procedure,  again,  will  probably  stop. 

C.   SDHHAEI 

Sophisticated   systems   to   warn   of   nuclear   attack   are 
necessary   for   the    protection   of   the    United    States.       Also,    if 
the    Soviets   know    that  the   United   States    has   an   effective 
warning   system,    they   are   less    likely    to   initiate    an    attack. 
Since  both    the    United  States    and   the    USSR    possess    effective 
warning   systems,    both   sides    have   less   incentive    to    launch   an 
attack,    and   the    world   is   more    stable   as  a    result. 

The   Missile    Attack  Warning    System   is   designed    to   make 
sure    that   the   decision  to  go   to  war   is  not    driven   by   a    flock 
of   geese  or   a   defective   computer   chip.      A    human    is   always   in 
the   decision  loop. 

Although   the   launch-on-warning   policy    would   improve 
reaction  time   in   performing    a   counter-strike   launch,    it 
seriously   impairs   rational   decision    making   in  a    time    of 
extreme    stress.      A    launch-on-warning    policy  puts   the 
President   in   the    "hot"  seat    nearly   once   per   year.      But    such 
a   burden,    even    once    every   4- year    term,    would   be    enough    for 
any   President.       The   risk    of    accidental   nuclear   war   under 
launch-on-warning   is   great   enough   to   make   this   policy   very 
unattractive. 

Launch-under-attack,    on    the  other    hand,    is    much    safer, 
given   its   requirement  for  dual    phenomenology.      The   condi- 
tions  necessary    for    a  double   false   alarm    (a   false   alarm  in 
two   separate   systems)    to   occur  in    a    time   overlap    of   at   least 
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3  minutes  make  the  probability  of  accidental  nuclear  war 
extremely  small.   The  President  must  still  undergo  immense 
pressure,  but  he  can  be  virtually  assured  of  making  the 
correct  response  decision. 
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APPENDIX    h 
ACRONYMS    AND    ABBREVIATIONS 

ADCOM  Aerospace   Defense   Command 

ANMCC  alternate   National   Military   Command   Center 

BMEWS  Ballistic   Missile   Early    Warning   System 

CINC    NORAD  Commander-in-Chief,    North    American 

Aerospace   Defense  Command 

CINC    SAC  Commander-in-Chief,    Strategic   Air    Command 

DEW  Distant   Early    Warning   Line 

EMP  Electromagnetic    Pulse 

ICBM  Intercontinental   Ballistic   Missile 

JCS  Joint   Chiefs    of    Staff 

MIRV  Multiple   Independently   Targeted  Re-entry 

Vehicle 

NCA  National  Command  Authority 

NCMC  North  American  Aerospace  Defense  Command 

Cheyenne  Mountain  Complex 

NMCC  National  Military  Command  Center 

NORAD  North  American  Aerospace  Defense  Command 

PARCS  Perimeter  Acquisition  Radar  Attack 

Characterization  System 

SAC  Strategic  Air  Command 

SEWS  Satellite  Early  Warning  System 
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SLBM  Submarine-Launched   Ballistic   Missile 

SOSUS  Sound    Surveillance   System 

SPASUR  dnited  States    Navy    Space    Surveillance    Network 

SRF  (Soviet)     Strategic   Rocket   Forces 
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